diff --git a/include/envoy/grpc/status.h b/include/envoy/grpc/status.h
index b967d3e29164..3715571bbb66 100644
--- a/include/envoy/grpc/status.h
+++ b/include/envoy/grpc/status.h
@@ -9,8 +9,6 @@ class Status {
 public:
   using GrpcStatus = int64_t;
 
-  // If this enum is changed, then the std::unordered_map in Envoy::Grpc::Utility::nameToGrpcStatus
-  // located at: //source/common/access_log/grpc/status.cc must also be changed.
   enum WellKnownGrpcStatus {
     // The RPC completed successfully.
     Ok = 0,
diff --git a/include/envoy/http/BUILD b/include/envoy/http/BUILD
index f84ccbc9c60a..41d7af731db8 100644
--- a/include/envoy/http/BUILD
+++ b/include/envoy/http/BUILD
@@ -128,6 +128,7 @@ envoy_cc_library(
 envoy_cc_library(
     name = "metadata_interface",
     hdrs = ["metadata_interface.h"],
+    external_deps = ["abseil_node_hash_map"],
 )
 
 envoy_cc_library(
diff --git a/include/envoy/http/header_map.h b/include/envoy/http/header_map.h
index 8692e3526735..bc5e9338a2dc 100644
--- a/include/envoy/http/header_map.h
+++ b/include/envoy/http/header_map.h
@@ -6,7 +6,6 @@
 #include <iostream>
 #include <memory>
 #include <string>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/common/pure.h"
diff --git a/include/envoy/http/metadata_interface.h b/include/envoy/http/metadata_interface.h
index dc8dc0e4e65c..3874aa905a49 100644
--- a/include/envoy/http/metadata_interface.h
+++ b/include/envoy/http/metadata_interface.h
@@ -3,9 +3,10 @@
 #include <functional>
 #include <iostream>
 #include <memory>
-#include <unordered_map>
 #include <vector>
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Http {
 
@@ -20,7 +21,7 @@ constexpr uint8_t END_METADATA_FLAG = 0x4;
 // TODO(soya3129): Respect max_frame_size after nghttp2 #1250 is resolved.
 constexpr uint64_t METADATA_MAX_PAYLOAD_SIZE = 16384;
 
-using UnorderedStringMap = std::unordered_map<std::string, std::string>;
+using UnorderedStringMap = absl::node_hash_map<std::string, std::string>;
 
 class MetadataMap : public UnorderedStringMap {
 public:
diff --git a/include/envoy/runtime/BUILD b/include/envoy/runtime/BUILD
index cb0aff14c0ef..b80d180dedaa 100644
--- a/include/envoy/runtime/BUILD
+++ b/include/envoy/runtime/BUILD
@@ -11,7 +11,10 @@ envoy_package()
 envoy_cc_library(
     name = "runtime_interface",
     hdrs = ["runtime.h"],
-    external_deps = ["abseil_optional"],
+    external_deps = [
+        "abseil_node_hash_map",
+        "abseil_optional",
+    ],
     deps = [
         "//include/envoy/stats:stats_interface",
         "//include/envoy/thread_local:thread_local_interface",
diff --git a/include/envoy/runtime/runtime.h b/include/envoy/runtime/runtime.h
index bdd2f67114fd..35737b6d0745 100644
--- a/include/envoy/runtime/runtime.h
+++ b/include/envoy/runtime/runtime.h
@@ -5,7 +5,6 @@
 #include <limits>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/common/pure.h"
@@ -17,6 +16,7 @@
 #include "common/singleton/threadsafe_singleton.h"
 
 #include "absl/container/flat_hash_map.h"
+#include "absl/container/node_hash_map.h"
 #include "absl/types/optional.h"
 
 namespace Envoy {
@@ -253,7 +253,7 @@ class Loader {
    * a key, use an empty string as the value.
    * @param values the values to merge
    */
-  virtual void mergeValues(const std::unordered_map<std::string, std::string>& values) PURE;
+  virtual void mergeValues(const absl::node_hash_map<std::string, std::string>& values) PURE;
 
   /**
    * Initiate all RTDS subscriptions. The `on_done` callback is invoked when all RTDS requests
diff --git a/include/envoy/server/overload_manager.h b/include/envoy/server/overload_manager.h
index e10812add8fd..24ddd16cfd6c 100644
--- a/include/envoy/server/overload_manager.h
+++ b/include/envoy/server/overload_manager.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 
 #include "envoy/common/pure.h"
 #include "envoy/thread_local/thread_local.h"
diff --git a/include/envoy/upstream/BUILD b/include/envoy/upstream/BUILD
index 2755da336b56..d67f7b242f40 100644
--- a/include/envoy/upstream/BUILD
+++ b/include/envoy/upstream/BUILD
@@ -11,6 +11,9 @@ envoy_package()
 envoy_cc_library(
     name = "cluster_manager_interface",
     hdrs = ["cluster_manager.h"],
+    external_deps = [
+        "abseil_node_hash_map",
+    ],
     deps = [
         ":health_checker_interface",
         ":load_balancer_interface",
diff --git a/include/envoy/upstream/cluster_manager.h b/include/envoy/upstream/cluster_manager.h
index ed0c3935bb08..936fa439375b 100644
--- a/include/envoy/upstream/cluster_manager.h
+++ b/include/envoy/upstream/cluster_manager.h
@@ -4,7 +4,6 @@
 #include <functional>
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/access_log/access_log.h"
 #include "envoy/api/api.h"
@@ -32,6 +31,9 @@
 #include "envoy/upstream/thread_local_cluster.h"
 #include "envoy/upstream/upstream.h"
 
+#include "absl/container/flat_hash_set.h"
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Upstream {
 
@@ -123,7 +125,7 @@ class ClusterManager {
   virtual void
   initializeSecondaryClusters(const envoy::config::bootstrap::v3::Bootstrap& bootstrap) PURE;
 
-  using ClusterInfoMap = std::unordered_map<std::string, std::reference_wrapper<const Cluster>>;
+  using ClusterInfoMap = absl::node_hash_map<std::string, std::reference_wrapper<const Cluster>>;
 
   /**
    * @return ClusterInfoMap all current clusters. These are the primary (not thread local)
@@ -131,7 +133,7 @@ class ClusterManager {
    */
   virtual ClusterInfoMap clusters() PURE;
 
-  using ClusterSet = std::unordered_set<std::string>;
+  using ClusterSet = absl::flat_hash_set<std::string>;
 
   /**
    * @return const ClusterSet& providing the cluster names that are eligible as
diff --git a/include/envoy/upstream/upstream.h b/include/envoy/upstream/upstream.h
index cd15d0bb3dff..b2d72e2cea24 100644
--- a/include/envoy/upstream/upstream.h
+++ b/include/envoy/upstream/upstream.h
@@ -211,7 +211,7 @@ using HostVector = std::vector<HostSharedPtr>;
 using HealthyHostVector = Phantom<HostVector, Healthy>;
 using DegradedHostVector = Phantom<HostVector, Degraded>;
 using ExcludedHostVector = Phantom<HostVector, Excluded>;
-using HostMap = std::unordered_map<std::string, Upstream::HostSharedPtr>;
+using HostMap = absl::node_hash_map<std::string, Upstream::HostSharedPtr>;
 using HostVectorSharedPtr = std::shared_ptr<HostVector>;
 using HostVectorConstSharedPtr = std::shared_ptr<const HostVector>;
 
@@ -221,7 +221,7 @@ using ExcludedHostVectorConstSharedPtr = std::shared_ptr<const ExcludedHostVecto
 
 using HostListPtr = std::unique_ptr<HostVector>;
 using LocalityWeightsMap =
-    std::unordered_map<envoy::config::core::v3::Locality, uint32_t, LocalityHash, LocalityEqualTo>;
+    absl::node_hash_map<envoy::config::core::v3::Locality, uint32_t, LocalityHash, LocalityEqualTo>;
 using PriorityState = std::vector<std::pair<HostListPtr, LocalityWeightsMap>>;
 
 /**
diff --git a/source/common/access_log/BUILD b/source/common/access_log/BUILD
index 08408b26a9cf..00bfcb101f79 100644
--- a/source/common/access_log/BUILD
+++ b/source/common/access_log/BUILD
@@ -12,7 +12,9 @@ envoy_cc_library(
     name = "access_log_lib",
     srcs = ["access_log_impl.cc"],
     hdrs = ["access_log_impl.h"],
-    external_deps = ["abseil_hash"],
+    external_deps = [
+        "abseil_hash",
+    ],
     deps = [
         "//include/envoy/access_log:access_log_interface",
         "//include/envoy/config:typed_config_interface",
diff --git a/source/common/access_log/access_log_impl.h b/source/common/access_log/access_log_impl.h
index 19264b2238d6..657a7d069cf5 100644
--- a/source/common/access_log/access_log_impl.h
+++ b/source/common/access_log/access_log_impl.h
@@ -2,7 +2,6 @@
 
 #include <cstdint>
 #include <string>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
@@ -17,6 +16,7 @@
 #include "common/http/header_utility.h"
 #include "common/protobuf/protobuf.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/hash/hash.h"
 
 namespace Envoy {
@@ -207,7 +207,7 @@ class ResponseFlagFilter : public Filter {
 class GrpcStatusFilter : public Filter {
 public:
   using GrpcStatusHashSet =
-      std::unordered_set<Grpc::Status::GrpcStatus, absl::Hash<Grpc::Status::GrpcStatus>>;
+      absl::node_hash_set<Grpc::Status::GrpcStatus, absl::Hash<Grpc::Status::GrpcStatus>>;
 
   GrpcStatusFilter(const envoy::config::accesslog::v3::GrpcStatusFilter& config);
 
diff --git a/source/common/access_log/access_log_manager_impl.h b/source/common/access_log/access_log_manager_impl.h
index 2bf745cf41bf..1727a0bbf053 100644
--- a/source/common/access_log/access_log_manager_impl.h
+++ b/source/common/access_log/access_log_manager_impl.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 
 #include "envoy/access_log/access_log.h"
 #include "envoy/api/api.h"
@@ -14,6 +13,8 @@
 #include "common/common/logger.h"
 #include "common/common/thread.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 
 #define ACCESS_LOG_FILE_STATS(COUNTER, GAUGE)                                                      \
@@ -51,7 +52,7 @@ class AccessLogManagerImpl : public AccessLogManager, Logger::Loggable<Logger::I
   Event::Dispatcher& dispatcher_;
   Thread::BasicLockable& lock_;
   AccessLogFileStats file_stats_;
-  std::unordered_map<std::string, AccessLogFileSharedPtr> access_logs_;
+  absl::node_hash_map<std::string, AccessLogFileSharedPtr> access_logs_;
 };
 
 /**
diff --git a/source/common/common/BUILD b/source/common/common/BUILD
index 05758f4fe50e..d3b6bc9741ce 100644
--- a/source/common/common/BUILD
+++ b/source/common/common/BUILD
@@ -347,6 +347,7 @@ envoy_cc_library(
     name = "utility_lib",
     srcs = ["utility.cc"],
     hdrs = ["utility.h"],
+    external_deps = ["abseil_node_hash_map"],
     deps = [
         ":assert_lib",
         ":hash_lib",
diff --git a/source/common/common/hash.h b/source/common/common/hash.h
index 38fb20a0f9cc..c29b9effa89d 100644
--- a/source/common/common/hash.h
+++ b/source/common/common/hash.h
@@ -1,8 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
-#include <unordered_set>
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
diff --git a/source/common/common/perf_annotation.h b/source/common/common/perf_annotation.h
index 5701eaa68c32..7187244322d0 100644
--- a/source/common/common/perf_annotation.h
+++ b/source/common/common/perf_annotation.h
@@ -4,11 +4,11 @@
 
 #include <chrono>
 #include <cstdint>
-#include <unordered_map>
 
 #include "common/common/thread.h"
 #include "common/common/utility.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/string_view.h"
 
 // Performance Annotation system, enabled with
@@ -139,7 +139,7 @@ class PerfAnnotationContext {
     }
   };
 
-  using DurationStatsMap = std::unordered_map<CategoryDescription, DurationStats, Hash>;
+  using DurationStatsMap = absl::node_hash_map<CategoryDescription, DurationStats, Hash>;
 
   // Maps {category, description} to DurationStats.
 #if PERF_THREAD_SAFE
diff --git a/source/common/common/utility.cc b/source/common/common/utility.cc
index eb7ba3619a39..2017bbcdfa66 100644
--- a/source/common/common/utility.cc
+++ b/source/common/common/utility.cc
@@ -15,6 +15,7 @@
 #include "common/common/hash.h"
 #include "common/singleton/const_singleton.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/ascii.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_join.h"
@@ -85,7 +86,7 @@ std::string DateFormatter::fromTime(const SystemTime& time) const {
       SpecifierOffsets specifier_offsets;
     };
     // A map is used to keep different formatted format strings at a given second.
-    std::unordered_map<std::string, const Formatted> formatted;
+    absl::node_hash_map<std::string, const Formatted> formatted;
   };
   static thread_local CachedTime cached_time;
 
@@ -101,9 +102,11 @@ std::string DateFormatter::fromTime(const SystemTime& time) const {
     // Remove all the expired cached items.
     for (auto it = cached_time.formatted.cbegin(); it != cached_time.formatted.cend();) {
       if (it->second.epoch_time_seconds != epoch_time_seconds) {
-        it = cached_time.formatted.erase(it);
+        auto next_it = std::next(it);
+        cached_time.formatted.erase(it);
+        it = next_it;
       } else {
-        it++;
+        ++it;
       }
     }
 
diff --git a/source/common/common/utility.h b/source/common/common/utility.h
index e990a4e662ef..0101fd3d9fd9 100644
--- a/source/common/common/utility.h
+++ b/source/common/common/utility.h
@@ -5,7 +5,6 @@
 #include <set>
 #include <sstream>
 #include <string>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/common/interval_set.h"
diff --git a/source/common/config/config_provider_impl.h b/source/common/config/config_provider_impl.h
index 157941124d29..144332fe23b0 100644
--- a/source/common/config/config_provider_impl.h
+++ b/source/common/config/config_provider_impl.h
@@ -391,10 +391,10 @@ class ConfigProviderManagerImplBase : public ConfigProviderManager, public Singl
 protected:
   // Ordered set for deterministic config dump output.
   using ConfigProviderSet = std::set<ConfigProvider*>;
-  using ConfigProviderMap = std::unordered_map<ConfigProviderInstanceType,
-                                               std::unique_ptr<ConfigProviderSet>, EnumClassHash>;
+  using ConfigProviderMap = absl::node_hash_map<ConfigProviderInstanceType,
+                                                std::unique_ptr<ConfigProviderSet>, EnumClassHash>;
   using ConfigSubscriptionMap =
-      std::unordered_map<uint64_t, std::weak_ptr<ConfigSubscriptionCommonBase>>;
+      absl::node_hash_map<uint64_t, std::weak_ptr<ConfigSubscriptionCommonBase>>;
 
   ConfigProviderManagerImplBase(Server::Admin& admin, const std::string& config_name);
 
diff --git a/source/common/config/delta_subscription_state.h b/source/common/config/delta_subscription_state.h
index 00693a1abe2c..1e21ba3a8efd 100644
--- a/source/common/config/delta_subscription_state.h
+++ b/source/common/config/delta_subscription_state.h
@@ -13,6 +13,8 @@
 #include "common/config/pausable_ack_queue.h"
 #include "common/config/watch_map.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Config {
 
@@ -81,7 +83,7 @@ class DeltaSubscriptionState : public Logger::Loggable<Logger::Id::config> {
   // names we are currently interested in. Those in the waitingForServer state currently don't have
   // any version for that resource: we need to inform the server if we lose interest in them, but we
   // also need to *not* include them in the initial_resource_versions map upon a reconnect.
-  std::unordered_map<std::string, ResourceVersion> resource_versions_;
+  absl::node_hash_map<std::string, ResourceVersion> resource_versions_;
   // The keys of resource_versions_. Only tracked separately because std::map does not provide an
   // iterator into just its keys, e.g. for use in std::set_difference.
   std::set<std::string> resource_names_;
@@ -94,8 +96,8 @@ class DeltaSubscriptionState : public Logger::Loggable<Logger::Id::config> {
   bool any_request_sent_yet_in_current_stream_{};
 
   // Tracks changes in our subscription interest since the previous DeltaDiscoveryRequest we sent.
-  // Can't use unordered_set due to ordering issues in gTest expectation matching.
-  // Feel free to change to unordered if you can figure out how to make it work.
+  // TODO: Can't use absl::flat_hash_set due to ordering issues in gTest expectation matching.
+  // Feel free to change to an unordered container once we figure out how to make it work.
   std::set<std::string> names_added_;
   std::set<std::string> names_removed_;
 };
diff --git a/source/common/config/grpc_mux_impl.cc b/source/common/config/grpc_mux_impl.cc
index e97d55362445..907bf9148adf 100644
--- a/source/common/config/grpc_mux_impl.cc
+++ b/source/common/config/grpc_mux_impl.cc
@@ -1,7 +1,5 @@
 #include "common/config/grpc_mux_impl.h"
 
-#include <unordered_set>
-
 #include "envoy/service/discovery/v3/discovery.pb.h"
 
 #include "common/config/decoded_resource_impl.h"
@@ -11,6 +9,7 @@
 #include "common/protobuf/protobuf.h"
 
 #include "absl/container/btree_map.h"
+#include "absl/container/node_hash_set.h"
 
 namespace Envoy {
 namespace Config {
@@ -36,7 +35,7 @@ void GrpcMuxImpl::sendDiscoveryRequest(const std::string& type_url) {
   request.mutable_resource_names()->Clear();
 
   // Maintain a set to avoid dupes.
-  std::unordered_set<std::string> resources;
+  absl::node_hash_set<std::string> resources;
   for (const auto* watch : api_state.watches_) {
     for (const std::string& resource : watch->resources_) {
       if (resources.count(resource) == 0) {
diff --git a/source/common/config/grpc_mux_impl.h b/source/common/config/grpc_mux_impl.h
index 4480387219a8..d735bc12c1cf 100644
--- a/source/common/config/grpc_mux_impl.h
+++ b/source/common/config/grpc_mux_impl.h
@@ -3,7 +3,6 @@
 #include <cstdint>
 #include <memory>
 #include <queue>
-#include <unordered_map>
 
 #include "envoy/api/v2/discovery.pb.h"
 #include "envoy/common/random_generator.h"
@@ -21,6 +20,8 @@
 #include "common/config/grpc_stream.h"
 #include "common/config/utility.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Config {
 /**
@@ -131,7 +132,7 @@ class GrpcMuxImpl : public GrpcMux,
   const LocalInfo::LocalInfo& local_info_;
   const bool skip_subsequent_node_;
   bool first_stream_request_;
-  std::unordered_map<std::string, ApiState> api_state_;
+  absl::node_hash_map<std::string, ApiState> api_state_;
   // Envoy's dependency ordering.
   std::list<std::string> subscriptions_;
 
diff --git a/source/common/config/metadata.h b/source/common/config/metadata.h
index 3c59c77a2083..ed4fcd96c270 100644
--- a/source/common/config/metadata.h
+++ b/source/common/config/metadata.h
@@ -2,7 +2,6 @@
 
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/core/v3/base.pb.h"
 #include "envoy/config/typed_metadata.h"
@@ -14,6 +13,8 @@
 #include "common/protobuf/protobuf.h"
 #include "common/shared_pool/shared_pool.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Config {
 
@@ -123,7 +124,7 @@ template <typename factoryClass> class TypedMetadataImpl : public TypedMetadata
     }
   }
 
-  std::unordered_map<std::string, std::unique_ptr<const TypedMetadata::Object>> data_;
+  absl::node_hash_map<std::string, std::unique_ptr<const TypedMetadata::Object>> data_;
 };
 
 } // namespace Config
diff --git a/source/common/config/utility.cc b/source/common/config/utility.cc
index 6b5499def902..e42ee777a156 100644
--- a/source/common/config/utility.cc
+++ b/source/common/config/utility.cc
@@ -1,7 +1,5 @@
 #include "common/config/utility.h"
 
-#include <unordered_set>
-
 #include "envoy/config/bootstrap/v3/bootstrap.pb.h"
 #include "envoy/config/cluster/v3/cluster.pb.h"
 #include "envoy/config/core/v3/address.pb.h"
diff --git a/source/common/config/well_known_names.h b/source/common/config/well_known_names.h
index a2cd01dfcdf8..30698815f9ba 100644
--- a/source/common/config/well_known_names.h
+++ b/source/common/config/well_known_names.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/common/exception.h"
diff --git a/source/common/filesystem/inotify/watcher_impl.h b/source/common/filesystem/inotify/watcher_impl.h
index 40f903f43e4a..9b416f5c9c03 100644
--- a/source/common/filesystem/inotify/watcher_impl.h
+++ b/source/common/filesystem/inotify/watcher_impl.h
@@ -3,7 +3,6 @@
 #include <cstdint>
 #include <list>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/api/api.h"
 #include "envoy/event/dispatcher.h"
@@ -11,6 +10,8 @@
 
 #include "common/common/logger.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Filesystem {
 
@@ -43,7 +44,7 @@ class WatcherImpl : public Watcher, Logger::Loggable<Logger::Id::file> {
   Api::Api& api_;
   int inotify_fd_;
   Event::FileEventPtr inotify_event_;
-  std::unordered_map<int, DirectoryWatch> callback_map_;
+  absl::node_hash_map<int, DirectoryWatch> callback_map_;
 };
 
 } // namespace Filesystem
diff --git a/source/common/filesystem/kqueue/watcher_impl.h b/source/common/filesystem/kqueue/watcher_impl.h
index b61ba721b531..e34d90548979 100644
--- a/source/common/filesystem/kqueue/watcher_impl.h
+++ b/source/common/filesystem/kqueue/watcher_impl.h
@@ -11,6 +11,8 @@
 #include "common/common/linked_object.h"
 #include "common/common/logger.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Filesystem {
 
@@ -47,7 +49,7 @@ class WatcherImpl : public Watcher, Logger::Loggable<Logger::Id::file> {
 
   Api::Api& api_;
   int queue_;
-  std::unordered_map<int, FileWatchPtr> watches_;
+  absl::node_hash_map<int, FileWatchPtr> watches_;
   Event::FileEventPtr kqueue_event_;
 };
 
diff --git a/source/common/filesystem/win32/filesystem_impl.cc b/source/common/filesystem/win32/filesystem_impl.cc
index ca9e246b13b7..d868fe567c00 100644
--- a/source/common/filesystem/win32/filesystem_impl.cc
+++ b/source/common/filesystem/win32/filesystem_impl.cc
@@ -12,6 +12,7 @@
 #include "common/common/fmt.h"
 #include "common/filesystem/filesystem_impl.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_split.h"
 
@@ -156,7 +157,7 @@ static const char filename_char_table[] = {
 // The "COM#" and "LPT#" names below have boolean flag requiring a [1-9] suffix.
 // This list can be avoided by observing dwFileAttributes & FILE_ATTRIBUTE_DEVICE
 // within WIN32_FILE_ATTRIBUTE_DATA or WIN32_FIND_DATA results.
-std::unordered_map<std::string, bool> pathelt_table = {
+absl::node_hash_map<std::string, bool> pathelt_table = {
     {"CON", false}, {"NUL", false}, {"AUX", false}, {"PRN", false}, {"COM", true}, {"LPT", true}
 };
 
diff --git a/source/common/filesystem/win32/watcher_impl.h b/source/common/filesystem/win32/watcher_impl.h
index f107f541eea7..1eccf7aba5c6 100644
--- a/source/common/filesystem/win32/watcher_impl.h
+++ b/source/common/filesystem/win32/watcher_impl.h
@@ -7,7 +7,6 @@
 #include <list>
 #include <locale>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/api/api.h"
 #include "envoy/event/dispatcher.h"
@@ -18,6 +17,8 @@
 #include "common/common/logger.h"
 #include "common/common/thread_impl.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Filesystem {
 
@@ -56,7 +57,7 @@ class WatcherImpl : public Watcher, Logger::Loggable<Logger::Id::file> {
   typedef std::unique_ptr<DirectoryWatch> DirectoryWatchPtr;
 
   Api::Api& api_;
-  std::unordered_map<std::string, DirectoryWatchPtr> callback_map_;
+  absl::node_hash_map<std::string, DirectoryWatchPtr> callback_map_;
   Event::FileEventPtr directory_event_;
   os_fd_t event_write_;
   os_fd_t event_read_;
diff --git a/source/common/formatter/substitution_format_string.h b/source/common/formatter/substitution_format_string.h
index 97d3bd1e8a17..6d514cecc47d 100644
--- a/source/common/formatter/substitution_format_string.h
+++ b/source/common/formatter/substitution_format_string.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/core/v3/substitution_format_string.pb.h"
 #include "envoy/formatter/substitution_formatter.h"
diff --git a/source/common/formatter/substitution_formatter.h b/source/common/formatter/substitution_formatter.h
index 00b4be31ac0d..8336f3274f85 100644
--- a/source/common/formatter/substitution_formatter.h
+++ b/source/common/formatter/substitution_formatter.h
@@ -2,7 +2,6 @@
 
 #include <functional>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/common/time.h"
diff --git a/source/common/grpc/google_async_client_impl.h b/source/common/grpc/google_async_client_impl.h
index 6a576df3497a..5d339e7764a3 100644
--- a/source/common/grpc/google_async_client_impl.h
+++ b/source/common/grpc/google_async_client_impl.h
@@ -21,6 +21,7 @@
 #include "common/grpc/typed_async_client.h"
 #include "common/tracing/http_tracer_impl.h"
 
+#include "absl/container/node_hash_set.h"
 #include "grpcpp/generic/generic_stub.h"
 #include "grpcpp/grpcpp.h"
 #include "grpcpp/support/proto_buffer_writer.h"
@@ -109,7 +110,7 @@ class GoogleAsyncClientThreadLocal : public ThreadLocal::ThreadLocalObject,
   Thread::ThreadPtr completion_thread_;
   // Track all streams that are currently using this CQ, so we can notify them
   // on shutdown.
-  std::unordered_set<GoogleAsyncStreamImpl*> streams_;
+  absl::node_hash_set<GoogleAsyncStreamImpl*> streams_;
 };
 
 using GoogleAsyncClientThreadLocalPtr = std::unique_ptr<GoogleAsyncClientThreadLocal>;
diff --git a/source/common/http/BUILD b/source/common/http/BUILD
index 041c3508d650..9542d9eb4a93 100644
--- a/source/common/http/BUILD
+++ b/source/common/http/BUILD
@@ -344,6 +344,7 @@ envoy_cc_library(
     srcs = ["utility.cc"],
     hdrs = ["utility.h"],
     external_deps = [
+        "abseil_node_hash_set",
         "abseil_optional",
         "nghttp2",
     ],
diff --git a/source/common/http/utility.cc b/source/common/http/utility.cc
index cac031e3b2a0..28e8872851cd 100644
--- a/source/common/http/utility.cc
+++ b/source/common/http/utility.cc
@@ -23,6 +23,7 @@
 #include "common/protobuf/utility.h"
 #include "common/runtime/runtime_features.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/match.h"
 #include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
@@ -61,7 +62,7 @@ namespace {
 void validateCustomSettingsParameters(
     const envoy::config::core::v3::Http2ProtocolOptions& options) {
   std::vector<std::string> parameter_collisions, custom_parameter_collisions;
-  std::unordered_set<nghttp2_settings_entry, SettingsEntryHash, SettingsEntryEquals>
+  absl::node_hash_set<nghttp2_settings_entry, SettingsEntryHash, SettingsEntryEquals>
       custom_parameters;
   // User defined and named parameters with the same SETTINGS identifier can not both be set.
   for (const auto& it : options.custom_settings_parameters()) {
diff --git a/source/common/network/BUILD b/source/common/network/BUILD
index 95d412a0a71a..67e3e0be9899 100644
--- a/source/common/network/BUILD
+++ b/source/common/network/BUILD
@@ -163,7 +163,10 @@ envoy_cc_library(
 envoy_cc_library(
     name = "lc_trie_lib",
     hdrs = ["lc_trie.h"],
-    external_deps = ["abseil_int128"],
+    external_deps = [
+        "abseil_node_hash_set",
+        "abseil_int128",
+    ],
     deps = [
         ":address_lib",
         ":cidr_range_lib",
diff --git a/source/common/network/dns_impl.h b/source/common/network/dns_impl.h
index 44588fc4f52c..dc62e06adb11 100644
--- a/source/common/network/dns_impl.h
+++ b/source/common/network/dns_impl.h
@@ -2,7 +2,6 @@
 
 #include <cstdint>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/common/platform.h"
 #include "envoy/event/dispatcher.h"
@@ -13,6 +12,7 @@
 #include "common/common/logger.h"
 #include "common/common/utility.h"
 
+#include "absl/container/node_hash_map.h"
 #include "ares.h"
 
 namespace Envoy {
@@ -104,7 +104,7 @@ class DnsResolverImpl : public DnsResolver, protected Logger::Loggable<Logger::I
   ares_channel channel_;
   bool dirty_channel_{};
   const bool use_tcp_for_dns_lookups_;
-  std::unordered_map<int, Event::FileEventPtr> events_;
+  absl::node_hash_map<int, Event::FileEventPtr> events_;
 };
 
 } // namespace Network
diff --git a/source/common/network/lc_trie.h b/source/common/network/lc_trie.h
index aae1aa7c0ef7..dea6c6b928d8 100644
--- a/source/common/network/lc_trie.h
+++ b/source/common/network/lc_trie.h
@@ -2,7 +2,6 @@
 
 #include <algorithm>
 #include <climits>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/common/exception.h"
@@ -14,6 +13,7 @@
 #include "common/network/cidr_range.h"
 #include "common/network/utility.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/numeric/int128.h"
 #include "fmt/format.h"
 
@@ -230,7 +230,7 @@ template <class T> class LcTrie {
   using Ipv4 = uint32_t;
   using Ipv6 = absl::uint128;
 
-  using DataSet = std::unordered_set<T>;
+  using DataSet = absl::node_hash_set<T>;
   using DataSetSharedPtr = std::shared_ptr<DataSet>;
 
   /**
diff --git a/source/common/router/config_impl.h b/source/common/router/config_impl.h
index d5f51ec194fa..a32d19fbe742 100644
--- a/source/common/router/config_impl.h
+++ b/source/common/router/config_impl.h
@@ -8,7 +8,6 @@
 #include <memory>
 #include <regex>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/config/core/v3/base.pb.h"
@@ -32,6 +31,7 @@
 #include "common/router/tls_context_match_criteria_impl.h"
 #include "common/stats/symbol_table_impl.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/types/optional.h"
 
 namespace Envoy {
@@ -69,7 +69,7 @@ class PerFilterConfigs {
   const RouteSpecificFilterConfig* get(const std::string& name) const;
 
 private:
-  std::unordered_map<std::string, RouteSpecificFilterConfigConstSharedPtr> configs_;
+  absl::node_hash_map<std::string, RouteSpecificFilterConfigConstSharedPtr> configs_;
 };
 
 class RouteEntryImplBase;
@@ -919,14 +919,14 @@ class RouteMatcher {
 
 private:
   using WildcardVirtualHosts =
-      std::map<int64_t, std::unordered_map<std::string, VirtualHostSharedPtr>, std::greater<>>;
+      std::map<int64_t, absl::node_hash_map<std::string, VirtualHostSharedPtr>, std::greater<>>;
   using SubstringFunction = std::function<std::string(const std::string&, int)>;
   const VirtualHostImpl* findWildcardVirtualHost(const std::string& host,
                                                  const WildcardVirtualHosts& wildcard_virtual_hosts,
                                                  SubstringFunction substring_function) const;
 
   Stats::ScopePtr vhost_scope_;
-  std::unordered_map<std::string, VirtualHostSharedPtr> virtual_hosts_;
+  absl::node_hash_map<std::string, VirtualHostSharedPtr> virtual_hosts_;
   // std::greater as a minor optimization to iterate from more to less specific
   //
   // A note on using an unordered_map versus a vector of (string, VirtualHostSharedPtr) pairs:
diff --git a/source/common/router/header_formatter.h b/source/common/router/header_formatter.h
index 55d1206a1112..847657dba0d7 100644
--- a/source/common/router/header_formatter.h
+++ b/source/common/router/header_formatter.h
@@ -6,6 +6,7 @@
 
 #include "envoy/formatter/substitution_formatter.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/string_view.h"
 
 namespace Envoy {
@@ -45,7 +46,7 @@ class StreamInfoHeaderFormatter : public HeaderFormatter {
 private:
   FieldExtractor field_extractor_;
   const bool append_;
-  std::unordered_map<std::string, std::vector<Envoy::Formatter::FormatterProviderPtr>>
+  absl::node_hash_map<std::string, std::vector<Envoy::Formatter::FormatterProviderPtr>>
       start_time_formatters_;
 };
 
diff --git a/source/common/router/metadatamatchcriteria_impl.cc b/source/common/router/metadatamatchcriteria_impl.cc
index 8739d314cccf..88cfa4b229fd 100644
--- a/source/common/router/metadatamatchcriteria_impl.cc
+++ b/source/common/router/metadatamatchcriteria_impl.cc
@@ -9,7 +9,7 @@ MetadataMatchCriteriaImpl::extractMetadataMatchCriteria(const MetadataMatchCrite
 
   // Track locations of each name (from the parent) in v to make it
   // easier to replace them when the same name exists in matches.
-  std::unordered_map<std::string, std::size_t> existing;
+  absl::node_hash_map<std::string, std::size_t> existing;
 
   if (parent) {
     for (const auto& it : parent->metadata_match_criteria_) {
diff --git a/source/common/router/rds_impl.h b/source/common/router/rds_impl.h
index 0e8f6630e59a..cba4793acd5a 100644
--- a/source/common/router/rds_impl.h
+++ b/source/common/router/rds_impl.h
@@ -5,8 +5,6 @@
 #include <memory>
 #include <queue>
 #include <string>
-#include <unordered_map>
-#include <unordered_set>
 
 #include "envoy/admin/v3/config_dump.pb.h"
 #include "envoy/config/core/v3/config_source.pb.h"
@@ -36,6 +34,9 @@
 #include "common/router/route_config_update_receiver_impl.h"
 #include "common/router/vhds.h"
 
+#include "absl/container/node_hash_map.h"
+#include "absl/container/node_hash_set.h"
+
 namespace Envoy {
 namespace Router {
 
@@ -118,7 +119,7 @@ class RdsRouteConfigSubscription
 public:
   ~RdsRouteConfigSubscription() override;
 
-  std::unordered_set<RouteConfigProvider*>& routeConfigProviders() {
+  absl::node_hash_set<RouteConfigProvider*>& routeConfigProviders() {
     ASSERT(route_config_providers_.size() == 1 || route_config_providers_.empty());
     return route_config_providers_;
   }
@@ -169,7 +170,7 @@ class RdsRouteConfigSubscription
   RouteConfigProviderManagerImpl& route_config_provider_manager_;
   const uint64_t manager_identifier_;
   // TODO(lambdai): Prove that a subscription has exactly one provider and remove the container.
-  std::unordered_set<RouteConfigProvider*> route_config_providers_;
+  absl::node_hash_set<RouteConfigProvider*> route_config_providers_;
   VhdsSubscriptionPtr vhds_subscription_;
   RouteConfigUpdatePtr config_update_info_;
   Common::CallbackManager<> update_callback_manager_;
@@ -253,9 +254,9 @@ class RouteConfigProviderManagerImpl : public RouteConfigProviderManager,
   // TODO(jsedgwick) These two members are prime candidates for the owned-entry list/map
   // as in ConfigTracker. I.e. the ProviderImpls would have an EntryOwner for these lists
   // Then the lifetime management stuff is centralized and opaque.
-  std::unordered_map<uint64_t, std::weak_ptr<RdsRouteConfigProviderImpl>>
+  absl::node_hash_map<uint64_t, std::weak_ptr<RdsRouteConfigProviderImpl>>
       dynamic_route_config_providers_;
-  std::unordered_set<RouteConfigProvider*> static_route_config_providers_;
+  absl::node_hash_set<RouteConfigProvider*> static_route_config_providers_;
   Server::ConfigTracker::EntryOwnerPtr config_tracker_entry_;
 
   friend class RdsRouteConfigSubscription;
diff --git a/source/common/router/route_config_update_receiver_impl.h b/source/common/router/route_config_update_receiver_impl.h
index 9bfa6940cbbe..a0e44f7975da 100644
--- a/source/common/router/route_config_update_receiver_impl.h
+++ b/source/common/router/route_config_update_receiver_impl.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/route/v3/route.pb.h"
 #include "envoy/config/route/v3/route_components.pb.h"
diff --git a/source/common/router/vhds.cc b/source/common/router/vhds.cc
index 47552981f38f..31d5b9d27d25 100644
--- a/source/common/router/vhds.cc
+++ b/source/common/router/vhds.cc
@@ -20,11 +20,11 @@ namespace Envoy {
 namespace Router {
 
 // Implements callbacks to handle DeltaDiscovery protocol for VirtualHostDiscoveryService
-VhdsSubscription::VhdsSubscription(RouteConfigUpdatePtr& config_update_info,
-                                   Server::Configuration::ServerFactoryContext& factory_context,
-                                   const std::string& stat_prefix,
-                                   std::unordered_set<RouteConfigProvider*>& route_config_providers,
-                                   envoy::config::core::v3::ApiVersion resource_api_version)
+VhdsSubscription::VhdsSubscription(
+    RouteConfigUpdatePtr& config_update_info,
+    Server::Configuration::ServerFactoryContext& factory_context, const std::string& stat_prefix,
+    absl::node_hash_set<RouteConfigProvider*>& route_config_providers,
+    envoy::config::core::v3::ApiVersion resource_api_version)
     : Envoy::Config::SubscriptionBase<envoy::config::route::v3::VirtualHost>(
           resource_api_version,
           factory_context.messageValidationContext().dynamicValidationVisitor(), "name"),
diff --git a/source/common/router/vhds.h b/source/common/router/vhds.h
index dc8bd87ded74..ea5be4074042 100644
--- a/source/common/router/vhds.h
+++ b/source/common/router/vhds.h
@@ -3,8 +3,6 @@
 #include <cstdint>
 #include <functional>
 #include <string>
-#include <unordered_map>
-#include <unordered_set>
 
 #include "envoy/config/core/v3/config_source.pb.h"
 #include "envoy/config/route/v3/route_components.pb.h"
@@ -25,6 +23,8 @@
 #include "common/init/target_impl.h"
 #include "common/protobuf/utility.h"
 
+#include "absl/container/node_hash_set.h"
+
 namespace Envoy {
 namespace Router {
 
@@ -42,7 +42,7 @@ class VhdsSubscription : Envoy::Config::SubscriptionBase<envoy::config::route::v
   VhdsSubscription(RouteConfigUpdatePtr& config_update_info,
                    Server::Configuration::ServerFactoryContext& factory_context,
                    const std::string& stat_prefix,
-                   std::unordered_set<RouteConfigProvider*>& route_config_providers,
+                   absl::node_hash_set<RouteConfigProvider*>& route_config_providers,
                    const envoy::config::core::v3::ApiVersion resource_api_version =
                        envoy::config::core::v3::ApiVersion::AUTO);
   ~VhdsSubscription() override { init_target_.ready(); }
@@ -74,7 +74,7 @@ class VhdsSubscription : Envoy::Config::SubscriptionBase<envoy::config::route::v
   VhdsStats stats_;
   Envoy::Config::SubscriptionPtr subscription_;
   Init::TargetImpl init_target_;
-  std::unordered_set<RouteConfigProvider*>& route_config_providers_;
+  absl::node_hash_set<RouteConfigProvider*>& route_config_providers_;
 };
 
 using VhdsSubscriptionPtr = std::unique_ptr<VhdsSubscription>;
diff --git a/source/common/runtime/runtime_impl.cc b/source/common/runtime/runtime_impl.cc
index 6b61b2211913..86c59606a80e 100644
--- a/source/common/runtime/runtime_impl.cc
+++ b/source/common/runtime/runtime_impl.cc
@@ -2,7 +2,6 @@
 
 #include <cstdint>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/bootstrap/v3/bootstrap.pb.h"
 #include "envoy/config/core/v3/config_source.pb.h"
@@ -23,6 +22,8 @@
 #include "common/protobuf/utility.h"
 #include "common/runtime/runtime_features.h"
 
+#include "absl/container/node_hash_map.h"
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/match.h"
 #include "absl/strings/numbers.h"
 
@@ -232,7 +233,7 @@ void SnapshotImpl::parseEntryFractionalPercentValue(Entry& entry) {
   entry.fractional_percent_value_ = converted_fractional_percent;
 }
 
-void AdminLayer::mergeValues(const std::unordered_map<std::string, std::string>& values) {
+void AdminLayer::mergeValues(const absl::node_hash_map<std::string, std::string>& values) {
   for (const auto& kv : values) {
     values_.erase(kv.first);
     if (!kv.second.empty()) {
@@ -350,7 +351,7 @@ LoaderImpl::LoaderImpl(Event::Dispatcher& dispatcher, ThreadLocal::SlotAllocator
     : generator_(generator), stats_(generateStats(store)), tls_(tls.allocateSlot()),
       config_(config), service_cluster_(local_info.clusterName()), api_(api),
       init_watcher_("RTDS", [this]() { onRtdsReady(); }), store_(store) {
-  std::unordered_set<std::string> layer_names;
+  absl::node_hash_set<std::string> layer_names;
   for (const auto& layer : config_.layers()) {
     auto ret = layer_names.insert(layer.name());
     if (!ret.second) {
@@ -488,7 +489,7 @@ SnapshotConstSharedPtr LoaderImpl::threadsafeSnapshot() {
   }
 }
 
-void LoaderImpl::mergeValues(const std::unordered_map<std::string, std::string>& values) {
+void LoaderImpl::mergeValues(const absl::node_hash_map<std::string, std::string>& values) {
   if (admin_layer_ == nullptr) {
     throw EnvoyException("No admin layer specified");
   }
diff --git a/source/common/runtime/runtime_impl.h b/source/common/runtime/runtime_impl.h
index d25e8d8ed25f..ee4c0cb3841c 100644
--- a/source/common/runtime/runtime_impl.h
+++ b/source/common/runtime/runtime_impl.h
@@ -3,7 +3,6 @@
 #include <cstdint>
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/api/api.h"
 #include "envoy/common/exception.h"
@@ -30,6 +29,7 @@
 #include "common/init/target_impl.h"
 #include "common/singleton/threadsafe_singleton.h"
 
+#include "absl/container/node_hash_map.h"
 #include "spdlog/spdlog.h"
 
 namespace Envoy {
@@ -153,7 +153,7 @@ class AdminLayer : public OverrideLayerImpl {
    * Merge the provided values into our entry map. An empty value indicates that a key should be
    * removed from our map.
    */
-  void mergeValues(const std::unordered_map<std::string, std::string>& values);
+  void mergeValues(const absl::node_hash_map<std::string, std::string>& values);
 
 private:
   RuntimeStats& stats_;
@@ -238,7 +238,7 @@ class LoaderImpl : public Loader, Logger::Loggable<Logger::Id::runtime> {
   void initialize(Upstream::ClusterManager& cm) override;
   const Snapshot& snapshot() override;
   SnapshotConstSharedPtr threadsafeSnapshot() override;
-  void mergeValues(const std::unordered_map<std::string, std::string>& values) override;
+  void mergeValues(const absl::node_hash_map<std::string, std::string>& values) override;
   void startRtdsSubscriptions(ReadyCallback on_done) override;
   Stats::Scope& getRootScope() override;
 
diff --git a/source/common/secret/sds_api.cc b/source/common/secret/sds_api.cc
index 42af9809767e..664de75f4439 100644
--- a/source/common/secret/sds_api.cc
+++ b/source/common/secret/sds_api.cc
@@ -1,7 +1,5 @@
 #include "common/secret/sds_api.h"
 
-#include <unordered_map>
-
 #include "envoy/api/v2/auth/cert.pb.h"
 #include "envoy/config/core/v3/config_source.pb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/cert.pb.h"
diff --git a/source/common/secret/secret_manager_impl.h b/source/common/secret/secret_manager_impl.h
index d7be0e8b6b54..799c7415d7ce 100644
--- a/source/common/secret/secret_manager_impl.h
+++ b/source/common/secret/secret_manager_impl.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unordered_map>
-
 #include "envoy/config/core/v3/config_source.pb.h"
 #include "envoy/extensions/transport_sockets/tls/v3/cert.pb.h"
 #include "envoy/secret/secret_manager.h"
@@ -13,6 +11,8 @@
 #include "common/common/logger.h"
 #include "common/secret/sds_api.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Secret {
 
@@ -115,22 +115,22 @@ class SecretManagerImpl : public SecretManager {
       ASSERT(num_deleted == 1, "");
     }
 
-    std::unordered_map<std::string, std::weak_ptr<SecretType>> dynamic_secret_providers_;
+    absl::node_hash_map<std::string, std::weak_ptr<SecretType>> dynamic_secret_providers_;
   };
 
   // Manages pairs of secret name and TlsCertificateConfigProviderSharedPtr.
-  std::unordered_map<std::string, TlsCertificateConfigProviderSharedPtr>
+  absl::node_hash_map<std::string, TlsCertificateConfigProviderSharedPtr>
       static_tls_certificate_providers_;
 
   // Manages pairs of secret name and CertificateValidationContextConfigProviderSharedPtr.
-  std::unordered_map<std::string, CertificateValidationContextConfigProviderSharedPtr>
+  absl::node_hash_map<std::string, CertificateValidationContextConfigProviderSharedPtr>
       static_certificate_validation_context_providers_;
 
-  std::unordered_map<std::string, TlsSessionTicketKeysConfigProviderSharedPtr>
+  absl::node_hash_map<std::string, TlsSessionTicketKeysConfigProviderSharedPtr>
       static_session_ticket_keys_providers_;
 
   // Manages pairs of secret name and GenericSecretConfigProviderSharedPtr.
-  std::unordered_map<std::string, GenericSecretConfigProviderSharedPtr>
+  absl::node_hash_map<std::string, GenericSecretConfigProviderSharedPtr>
       static_generic_secret_providers_;
 
   // map hash code of SDS config source and SdsApi object.
diff --git a/source/common/singleton/manager_impl.h b/source/common/singleton/manager_impl.h
index 6f55ad3fadb2..e6eb8cb9af97 100644
--- a/source/common/singleton/manager_impl.h
+++ b/source/common/singleton/manager_impl.h
@@ -1,12 +1,12 @@
 #pragma once
 
-#include <unordered_map>
-
 #include "envoy/singleton/manager.h"
 #include "envoy/thread/thread.h"
 
 #include "common/common/non_copyable.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Singleton {
 
@@ -24,7 +24,7 @@ class ManagerImpl : public Manager, NonCopyable {
   InstanceSharedPtr get(const std::string& name, SingletonFactoryCb cb) override;
 
 private:
-  std::unordered_map<std::string, std::weak_ptr<Instance>> singletons_;
+  absl::node_hash_map<std::string, std::weak_ptr<Instance>> singletons_;
   Thread::ThreadFactory& thread_factory_;
   const Thread::ThreadId run_tid_;
 };
diff --git a/source/common/stats/BUILD b/source/common/stats/BUILD
index 2a671b4c07ef..bc5c41f6e9e2 100644
--- a/source/common/stats/BUILD
+++ b/source/common/stats/BUILD
@@ -223,6 +223,7 @@ envoy_cc_library(
     name = "tag_producer_lib",
     srcs = ["tag_producer_impl.cc"],
     hdrs = ["tag_producer_impl.h"],
+    external_deps = ["abseil_node_hash_set"],
     deps = [
         ":tag_extractor_lib",
         "//include/envoy/stats:stats_interface",
diff --git a/source/common/stats/fake_symbol_table_impl.h b/source/common/stats/fake_symbol_table_impl.h
index 9e4c5422f7a5..19bfa00daa79 100644
--- a/source/common/stats/fake_symbol_table_impl.h
+++ b/source/common/stats/fake_symbol_table_impl.h
@@ -5,7 +5,6 @@
 #include <memory>
 #include <stack>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/common/exception.h"
diff --git a/source/common/stats/symbol_table_impl.h b/source/common/stats/symbol_table_impl.h
index 664c5b56dacb..09f79ac46cf5 100644
--- a/source/common/stats/symbol_table_impl.h
+++ b/source/common/stats/symbol_table_impl.h
@@ -5,7 +5,6 @@
 #include <memory>
 #include <stack>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/common/exception.h"
diff --git a/source/common/stats/tag_producer_impl.cc b/source/common/stats/tag_producer_impl.cc
index 84b2ab158142..255dfcaeed39 100644
--- a/source/common/stats/tag_producer_impl.cc
+++ b/source/common/stats/tag_producer_impl.cc
@@ -14,7 +14,7 @@ namespace Stats {
 TagProducerImpl::TagProducerImpl(const envoy::config::metrics::v3::StatsConfig& config) {
   // To check name conflict.
   reserveResources(config);
-  std::unordered_set<std::string> names = addDefaultExtractors(config);
+  absl::node_hash_set<std::string> names = addDefaultExtractors(config);
 
   for (const auto& tag_specifier : config.stats_tags()) {
     const std::string& name = tag_specifier.tag_name();
@@ -97,9 +97,9 @@ void TagProducerImpl::reserveResources(const envoy::config::metrics::v3::StatsCo
   default_tags_.reserve(config.stats_tags().size());
 }
 
-std::unordered_set<std::string>
+absl::node_hash_set<std::string>
 TagProducerImpl::addDefaultExtractors(const envoy::config::metrics::v3::StatsConfig& config) {
-  std::unordered_set<std::string> names;
+  absl::node_hash_set<std::string> names;
   if (!config.has_use_all_default_tags() || config.use_all_default_tags().value()) {
     for (const auto& desc : Config::TagNames::get().descriptorVec()) {
       names.emplace(desc.name_);
diff --git a/source/common/stats/tag_producer_impl.h b/source/common/stats/tag_producer_impl.h
index e8b27307b2b8..093d4021389b 100644
--- a/source/common/stats/tag_producer_impl.h
+++ b/source/common/stats/tag_producer_impl.h
@@ -4,8 +4,6 @@
 #include <functional>
 #include <memory>
 #include <string>
-#include <unordered_map>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/config/metrics/v3/stats.pb.h"
@@ -18,6 +16,7 @@
 #include "common/protobuf/protobuf.h"
 
 #include "absl/container/flat_hash_map.h"
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/string_view.h"
 
 namespace Envoy {
@@ -71,9 +70,9 @@ class TagProducerImpl : public TagProducer {
    * into a string-set for dup-detection against new stat names
    * specified in the configuration.
    * @param config const envoy::config::metrics::v2::StatsConfig& the config.
-   * @return names std::unordered_set<std::string> the set of names to populate
+   * @return names absl::node_hash_set<std::string> the set of names to populate
    */
-  std::unordered_set<std::string>
+  absl::node_hash_set<std::string>
   addDefaultExtractors(const envoy::config::metrics::v3::StatsConfig& config);
 
   /**
diff --git a/source/common/tcp_proxy/tcp_proxy.h b/source/common/tcp_proxy/tcp_proxy.h
index faa5727df255..871be2ad16f8 100644
--- a/source/common/tcp_proxy/tcp_proxy.h
+++ b/source/common/tcp_proxy/tcp_proxy.h
@@ -3,7 +3,6 @@
 #include <cstdint>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
@@ -30,6 +29,8 @@
 #include "common/tcp_proxy/upstream.h"
 #include "common/upstream/load_balancer_impl.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace TcpProxy {
 
@@ -421,7 +422,7 @@ class UpstreamDrainManager : public ThreadLocal::ThreadLocalObject {
   // This must be a map instead of set because there is no way to move elements
   // out of a set, and these elements get passed to deferredDelete() instead of
   // being deleted in-place. The key and value will always be equal.
-  std::unordered_map<Drainer*, DrainerPtr> drainers_;
+  absl::node_hash_map<Drainer*, DrainerPtr> drainers_;
 };
 
 } // namespace TcpProxy
diff --git a/source/common/upstream/cds_api_impl.cc b/source/common/upstream/cds_api_impl.cc
index 246bb0de1d27..b05ae5802cd3 100644
--- a/source/common/upstream/cds_api_impl.cc
+++ b/source/common/upstream/cds_api_impl.cc
@@ -14,6 +14,7 @@
 #include "common/config/utility.h"
 #include "common/protobuf/utility.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/str_join.h"
 
 namespace Envoy {
@@ -63,7 +64,7 @@ void CdsApiImpl::onConfigUpdate(const std::vector<Config::DecodedResourceRef>& a
             removed_resources.size());
 
   std::vector<std::string> exception_msgs;
-  std::unordered_set<std::string> cluster_names;
+  absl::node_hash_set<std::string> cluster_names;
   bool any_applied = false;
   for (const auto& resource : added_resources) {
     envoy::config::cluster::v3::Cluster cluster;
diff --git a/source/common/upstream/cluster_manager_impl.h b/source/common/upstream/cluster_manager_impl.h
index 2c8bf10e2469..c229395c1353 100644
--- a/source/common/upstream/cluster_manager_impl.h
+++ b/source/common/upstream/cluster_manager_impl.h
@@ -327,7 +327,7 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
       Network::ClientConnection& connection_;
     };
     using TcpConnectionsMap =
-        std::unordered_map<Network::ClientConnection*, std::unique_ptr<TcpConnContainer>>;
+        absl::node_hash_map<Network::ClientConnection*, std::unique_ptr<TcpConnContainer>>;
 
     struct ClusterEntry : public ThreadLocalCluster {
       ClusterEntry(ThreadLocalClusterManagerImpl& parent, ClusterInfoConstSharedPtr cluster,
@@ -387,9 +387,9 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
 
     // These maps are owned by the ThreadLocalClusterManagerImpl instead of the ClusterEntry
     // to prevent lifetime/ownership issues when a cluster is dynamically removed.
-    std::unordered_map<HostConstSharedPtr, ConnPoolsContainer> host_http_conn_pool_map_;
-    std::unordered_map<HostConstSharedPtr, TcpConnPoolsContainer> host_tcp_conn_pool_map_;
-    std::unordered_map<HostConstSharedPtr, TcpConnectionsMap> host_tcp_conn_map_;
+    absl::node_hash_map<HostConstSharedPtr, ConnPoolsContainer> host_http_conn_pool_map_;
+    absl::node_hash_map<HostConstSharedPtr, TcpConnPoolsContainer> host_tcp_conn_pool_map_;
+    absl::node_hash_map<HostConstSharedPtr, TcpConnectionsMap> host_tcp_conn_map_;
 
     std::list<Envoy::Upstream::ClusterUpdateCallbacks*> update_callbacks_;
     const PrioritySet* local_priority_set_{};
@@ -468,9 +468,9 @@ class ClusterManagerImpl : public ClusterManager, Logger::Loggable<Logger::Id::u
   };
 
   using PendingUpdatesPtr = std::unique_ptr<PendingUpdates>;
-  using PendingUpdatesByPriorityMap = std::unordered_map<uint32_t, PendingUpdatesPtr>;
+  using PendingUpdatesByPriorityMap = absl::node_hash_map<uint32_t, PendingUpdatesPtr>;
   using PendingUpdatesByPriorityMapPtr = std::unique_ptr<PendingUpdatesByPriorityMap>;
-  using ClusterUpdatesMap = std::unordered_map<std::string, PendingUpdatesByPriorityMapPtr>;
+  using ClusterUpdatesMap = absl::node_hash_map<std::string, PendingUpdatesByPriorityMapPtr>;
 
   void applyUpdates(const Cluster& cluster, uint32_t priority, PendingUpdates& updates);
   bool scheduleUpdate(const Cluster& cluster, uint32_t priority, bool mergeable,
diff --git a/source/common/upstream/eds.cc b/source/common/upstream/eds.cc
index 3433d608898c..d8dc0d21c242 100644
--- a/source/common/upstream/eds.cc
+++ b/source/common/upstream/eds.cc
@@ -47,7 +47,7 @@ EdsClusterImpl::EdsClusterImpl(
 void EdsClusterImpl::startPreInit() { subscription_->start({cluster_name_}); }
 
 void EdsClusterImpl::BatchUpdateHelper::batchUpdate(PrioritySet::HostUpdateCb& host_update_cb) {
-  std::unordered_map<std::string, HostSharedPtr> updated_hosts;
+  absl::node_hash_map<std::string, HostSharedPtr> updated_hosts;
   PriorityStateManager priority_state_manager(parent_, parent_.local_info_, &host_update_cb);
   for (const auto& locality_lb_endpoint : cluster_load_assignment_.endpoints()) {
     parent_.validateEndpointsForZoneAwareRouting(locality_lb_endpoint);
@@ -234,7 +234,7 @@ bool EdsClusterImpl::updateHostsPerLocality(
     const uint32_t priority, const uint32_t overprovisioning_factor, const HostVector& new_hosts,
     LocalityWeightsMap& locality_weights_map, LocalityWeightsMap& new_locality_weights_map,
     PriorityStateManager& priority_state_manager,
-    std::unordered_map<std::string, HostSharedPtr>& updated_hosts) {
+    absl::node_hash_map<std::string, HostSharedPtr>& updated_hosts) {
   const auto& host_set = priority_set_.getOrCreateHostSet(priority, overprovisioning_factor);
   HostVectorSharedPtr current_hosts_copy(new HostVector(host_set.hosts()));
 
diff --git a/source/common/upstream/eds.h b/source/common/upstream/eds.h
index b1eab5a10972..4ab24c38788a 100644
--- a/source/common/upstream/eds.h
+++ b/source/common/upstream/eds.h
@@ -47,13 +47,13 @@ class EdsClusterImpl
                       const std::string& system_version_info) override;
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason reason,
                             const EnvoyException* e) override;
-  using LocalityWeightsMap = std::unordered_map<envoy::config::core::v3::Locality, uint32_t,
-                                                LocalityHash, LocalityEqualTo>;
+  using LocalityWeightsMap = absl::node_hash_map<envoy::config::core::v3::Locality, uint32_t,
+                                                 LocalityHash, LocalityEqualTo>;
   bool updateHostsPerLocality(const uint32_t priority, const uint32_t overprovisioning_factor,
                               const HostVector& new_hosts, LocalityWeightsMap& locality_weights_map,
                               LocalityWeightsMap& new_locality_weights_map,
                               PriorityStateManager& priority_state_manager,
-                              std::unordered_map<std::string, HostSharedPtr>& updated_hosts);
+                              absl::node_hash_map<std::string, HostSharedPtr>& updated_hosts);
   bool validateUpdateSize(int num_resources);
 
   // ClusterImplBase
diff --git a/source/common/upstream/health_checker_base_impl.h b/source/common/upstream/health_checker_base_impl.h
index eaae6ddf93cb..ff2f62101f57 100644
--- a/source/common/upstream/health_checker_base_impl.h
+++ b/source/common/upstream/health_checker_base_impl.h
@@ -154,7 +154,7 @@ class HealthCheckerImplBase : public HealthChecker,
   const std::chrono::milliseconds unhealthy_interval_;
   const std::chrono::milliseconds unhealthy_edge_interval_;
   const std::chrono::milliseconds healthy_edge_interval_;
-  std::unordered_map<HostSharedPtr, ActiveHealthCheckSessionPtr> active_sessions_;
+  absl::node_hash_map<HostSharedPtr, ActiveHealthCheckSessionPtr> active_sessions_;
   const std::shared_ptr<const Network::TransportSocketOptionsImpl> transport_socket_options_;
   const MetadataConstSharedPtr transport_socket_match_metadata_;
 };
diff --git a/source/common/upstream/load_balancer_impl.h b/source/common/upstream/load_balancer_impl.h
index 2ec2f605cbd7..13ab0884f285 100644
--- a/source/common/upstream/load_balancer_impl.h
+++ b/source/common/upstream/load_balancer_impl.h
@@ -228,7 +228,7 @@ class ZoneAwareLoadBalancerBase : public LoadBalancerBase {
 
   struct HostsSourceHash {
     size_t operator()(const HostsSource& hs) const {
-      // This is only used for std::unordered_map keys, so we don't need a deterministic hash.
+      // This is only used for absl::node_hash_map keys, so we don't need a deterministic hash.
       size_t hash = std::hash<uint32_t>()(hs.priority_);
       hash = 37 * hash + std::hash<size_t>()(static_cast<std::size_t>(hs.source_type_));
       hash = 37 * hash + std::hash<uint32_t>()(hs.locality_index_);
@@ -387,7 +387,7 @@ class EdfLoadBalancerBase : public ZoneAwareLoadBalancerBase {
                                                 const HostsSource& source) PURE;
 
   // Scheduler for each valid HostsSource.
-  std::unordered_map<HostsSource, Scheduler, HostsSourceHash> scheduler_;
+  absl::node_hash_map<HostsSource, Scheduler, HostsSourceHash> scheduler_;
 };
 
 /**
@@ -422,7 +422,7 @@ class RoundRobinLoadBalancer : public EdfLoadBalancerBase {
     return hosts_to_use[rr_indexes_[source]++ % hosts_to_use.size()];
   }
 
-  std::unordered_map<HostsSource, uint64_t, HostsSourceHash> rr_indexes_;
+  absl::node_hash_map<HostsSource, uint64_t, HostsSourceHash> rr_indexes_;
 };
 
 /**
diff --git a/source/common/upstream/load_stats_reporter.cc b/source/common/upstream/load_stats_reporter.cc
index 1b4556487d63..fa5697e86fbd 100644
--- a/source/common/upstream/load_stats_reporter.cc
+++ b/source/common/upstream/load_stats_reporter.cc
@@ -152,7 +152,7 @@ void LoadStatsReporter::startLoadReportPeriod() {
   // problems due to referencing of temporaries in the below loop with Google's
   // internal string type. Consider this optimization when the string types
   // converge.
-  std::unordered_map<std::string, std::chrono::steady_clock::duration> existing_clusters;
+  absl::node_hash_map<std::string, std::chrono::steady_clock::duration> existing_clusters;
   if (message_->send_all_clusters()) {
     for (const auto& p : cm_.clusters()) {
       const std::string& cluster_name = p.first;
diff --git a/source/common/upstream/load_stats_reporter.h b/source/common/upstream/load_stats_reporter.h
index b89f3d4f75c8..bd6ecfb39389 100644
--- a/source/common/upstream/load_stats_reporter.h
+++ b/source/common/upstream/load_stats_reporter.h
@@ -66,7 +66,7 @@ class LoadStatsReporter
   envoy::service::load_stats::v3::LoadStatsRequest request_;
   std::unique_ptr<envoy::service::load_stats::v3::LoadStatsResponse> message_;
   // Map from cluster name to start of measurement interval.
-  std::unordered_map<std::string, std::chrono::steady_clock::duration> clusters_;
+  absl::node_hash_map<std::string, std::chrono::steady_clock::duration> clusters_;
   TimeSource& time_source_;
 };
 
diff --git a/source/common/upstream/original_dst_cluster.h b/source/common/upstream/original_dst_cluster.h
index 52d8e56a30dc..14970a46094a 100644
--- a/source/common/upstream/original_dst_cluster.h
+++ b/source/common/upstream/original_dst_cluster.h
@@ -3,7 +3,6 @@
 #include <cstdint>
 #include <functional>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/cluster/v3/cluster.pb.h"
 #include "envoy/secret/secret_manager.h"
diff --git a/source/common/upstream/outlier_detection_impl.h b/source/common/upstream/outlier_detection_impl.h
index c51cb134bfbf..dcaf3c638757 100644
--- a/source/common/upstream/outlier_detection_impl.h
+++ b/source/common/upstream/outlier_detection_impl.h
@@ -6,7 +6,6 @@
 #include <list>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
@@ -22,6 +21,8 @@
 #include "envoy/upstream/outlier_detection.h"
 #include "envoy/upstream/upstream.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Upstream {
 namespace Outlier {
@@ -413,7 +414,7 @@ class DetectorImpl : public Detector, public std::enable_shared_from_this<Detect
   EjectionsActiveHelper ejections_active_helper_{stats_.ejections_active_};
   Event::TimerPtr interval_timer_;
   std::list<ChangeStateCb> callbacks_;
-  std::unordered_map<HostSharedPtr, DetectorHostMonitorImpl*> host_monitors_;
+  absl::node_hash_map<HostSharedPtr, DetectorHostMonitorImpl*> host_monitors_;
   EventLoggerSharedPtr event_logger_;
 
   // EjectionPair for external and local origin events.
diff --git a/source/common/upstream/strict_dns_cluster.cc b/source/common/upstream/strict_dns_cluster.cc
index eb7477b5b5cf..279bf47bef27 100644
--- a/source/common/upstream/strict_dns_cluster.cc
+++ b/source/common/upstream/strict_dns_cluster.cc
@@ -118,7 +118,7 @@ void StrictDnsClusterImpl::ResolveTarget::startResolve() {
         if (status == Network::DnsResolver::ResolutionStatus::Success) {
           parent_.info_->stats().update_success_.inc();
 
-          std::unordered_map<std::string, HostSharedPtr> updated_hosts;
+          absl::node_hash_map<std::string, HostSharedPtr> updated_hosts;
           HostVector new_hosts;
           std::chrono::seconds ttl_refresh_rate = std::chrono::seconds::max();
           for (const auto& resp : response) {
diff --git a/source/common/upstream/subset_lb.cc b/source/common/upstream/subset_lb.cc
index cce4fe9ffff1..6fe34d4853b7 100644
--- a/source/common/upstream/subset_lb.cc
+++ b/source/common/upstream/subset_lb.cc
@@ -1,7 +1,6 @@
 #include "common/upstream/subset_lb.h"
 
 #include <memory>
-#include <unordered_set>
 
 #include "envoy/config/cluster/v3/cluster.pb.h"
 #include "envoy/config/core/v3/base.pb.h"
@@ -15,6 +14,8 @@
 #include "common/upstream/maglev_lb.h"
 #include "common/upstream/ring_hash_lb.h"
 
+#include "absl/container/node_hash_set.h"
+
 namespace Envoy {
 namespace Upstream {
 
@@ -366,7 +367,7 @@ void SubsetLoadBalancer::processSubsets(
     const HostVector& hosts_added, const HostVector& hosts_removed,
     std::function<void(LbSubsetEntryPtr)> update_cb,
     std::function<void(LbSubsetEntryPtr, HostPredicate, const SubsetMetadata&)> new_cb) {
-  std::unordered_set<LbSubsetEntryPtr> subsets_modified;
+  absl::node_hash_set<LbSubsetEntryPtr> subsets_modified;
 
   std::pair<const HostVector&, bool> steps[] = {{hosts_added, true}, {hosts_removed, false}};
   for (const auto& step : steps) {
@@ -602,11 +603,15 @@ void SubsetLoadBalancer::purgeEmptySubsets(LbSubsetMap& subsets) {
         stats_.lb_subsets_removed_.inc();
       }
 
-      it = subset_it->second.erase(it);
+      auto next_it = std::next(it);
+      subset_it->second.erase(it);
+      it = next_it;
     }
 
     if (subset_it->second.empty()) {
-      subset_it = subsets.erase(subset_it);
+      auto next_subset_it = std::next(subset_it);
+      subsets.erase(subset_it);
+      subset_it = next_subset_it;
     } else {
       subset_it++;
     }
@@ -691,8 +696,8 @@ void SubsetLoadBalancer::HostSubsetImpl::update(const HostVector& hosts_added,
   // that we maintain a consistent view of the metadata and saves on computation
   // since metadata lookups can be expensive.
   //
-  // We use an unordered_set because this can potentially be in the tens of thousands.
-  std::unordered_set<const Host*> matching_hosts;
+  // We use an unordered container because this can potentially be in the tens of thousands.
+  absl::node_hash_set<const Host*> matching_hosts;
 
   auto cached_predicate = [&matching_hosts](const auto& host) {
     return matching_hosts.count(&host) == 1;
diff --git a/source/common/upstream/subset_lb.h b/source/common/upstream/subset_lb.h
index f1691768f682..c9fcb8d64eed 100644
--- a/source/common/upstream/subset_lb.h
+++ b/source/common/upstream/subset_lb.h
@@ -4,7 +4,6 @@
 #include <map>
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/cluster/v3/cluster.pb.h"
 #include "envoy/runtime/runtime.h"
@@ -16,6 +15,7 @@
 #include "common/protobuf/utility.h"
 #include "common/upstream/upstream_impl.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/types/optional.h"
 
 namespace Envoy {
@@ -120,8 +120,8 @@ class SubsetLoadBalancer : public LoadBalancer, Logger::Loggable<Logger::Id::ups
 
   using LbSubsetEntryPtr = std::shared_ptr<LbSubsetEntry>;
   using SubsetSelectorMapPtr = std::shared_ptr<SubsetSelectorMap>;
-  using ValueSubsetMap = std::unordered_map<HashedValue, LbSubsetEntryPtr>;
-  using LbSubsetMap = std::unordered_map<std::string, ValueSubsetMap>;
+  using ValueSubsetMap = absl::node_hash_map<HashedValue, LbSubsetEntryPtr>;
+  using LbSubsetMap = absl::node_hash_map<std::string, ValueSubsetMap>;
   using SubsetSelectorFallbackParamsRef = std::reference_wrapper<SubsetSelectorFallbackParams>;
 
   class LoadBalancerContextWrapper : public LoadBalancerContext {
@@ -171,7 +171,7 @@ class SubsetLoadBalancer : public LoadBalancer, Logger::Loggable<Logger::Id::ups
   };
 
   struct SubsetSelectorMap {
-    std::unordered_map<std::string, SubsetSelectorMapPtr> subset_keys_;
+    absl::node_hash_map<std::string, SubsetSelectorMapPtr> subset_keys_;
     SubsetSelectorFallbackParams fallback_params_;
   };
 
diff --git a/source/common/upstream/upstream_impl.cc b/source/common/upstream/upstream_impl.cc
index 44fc4860a931..711b74076548 100644
--- a/source/common/upstream/upstream_impl.cc
+++ b/source/common/upstream/upstream_impl.cc
@@ -6,7 +6,6 @@
 #include <list>
 #include <memory>
 #include <string>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/config/cluster/v3/circuit_breaker.pb.h"
@@ -53,6 +52,7 @@
 #include "extensions/filters/network/common/utility.h"
 #include "extensions/transport_sockets/well_known_names.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/str_cat.h"
 
 namespace Envoy {
@@ -233,8 +233,8 @@ bool updateHealthFlag(const Host& updated_host, Host& existing_host, Host::Healt
 // Converts a set of hosts into a HostVector, excluding certain hosts.
 // @param hosts hosts to convert
 // @param excluded_hosts hosts to exclude from the resulting vector.
-HostVector filterHosts(const std::unordered_set<HostSharedPtr>& hosts,
-                       const std::unordered_set<HostSharedPtr>& excluded_hosts) {
+HostVector filterHosts(const absl::node_hash_set<HostSharedPtr>& hosts,
+                       const absl::node_hash_set<HostSharedPtr>& excluded_hosts) {
   HostVector net_hosts;
   net_hosts.reserve(hosts.size());
 
@@ -1360,7 +1360,7 @@ bool BaseDynamicClusterImpl::updateDynamicHostList(const HostVector& new_hosts,
   // do the same thing.
 
   // Keep track of hosts we see in new_hosts that we are able to match up with an existing host.
-  std::unordered_set<std::string> existing_hosts_for_current_priority(
+  absl::node_hash_set<std::string> existing_hosts_for_current_priority(
       current_priority_hosts.size());
   HostVector final_hosts;
   for (const HostSharedPtr& host : new_hosts) {
diff --git a/source/common/upstream/upstream_impl.h b/source/common/upstream/upstream_impl.h
index 3b42d06818c3..dad144554ed2 100644
--- a/source/common/upstream/upstream_impl.h
+++ b/source/common/upstream/upstream_impl.h
@@ -54,6 +54,7 @@
 
 #include "server/transport_socket_config_impl.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/synchronization/mutex.h"
 
 namespace Envoy {
@@ -498,12 +499,12 @@ class PrioritySetImpl : public PrioritySet {
                      const HostVector& hosts_removed,
                      absl::optional<uint32_t> overprovisioning_factor) override;
 
-    std::unordered_set<HostSharedPtr> all_hosts_added_;
-    std::unordered_set<HostSharedPtr> all_hosts_removed_;
+    absl::node_hash_set<HostSharedPtr> all_hosts_added_;
+    absl::node_hash_set<HostSharedPtr> all_hosts_removed_;
 
   private:
     PrioritySetImpl& parent_;
-    std::unordered_set<uint32_t> priorities_;
+    absl::node_hash_set<uint32_t> priorities_;
   };
 };
 
diff --git a/source/extensions/access_loggers/common/access_log_base.h b/source/extensions/access_loggers/common/access_log_base.h
index 75f3237a434c..4fc1aae87d6c 100644
--- a/source/extensions/access_loggers/common/access_log_base.h
+++ b/source/extensions/access_loggers/common/access_log_base.h
@@ -2,7 +2,6 @@
 
 #include <cstdint>
 #include <string>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/access_log/access_log.h"
diff --git a/source/extensions/access_loggers/file/config.cc b/source/extensions/access_loggers/file/config.cc
index 60c536131389..a3e817c71058 100644
--- a/source/extensions/access_loggers/file/config.cc
+++ b/source/extensions/access_loggers/file/config.cc
@@ -1,7 +1,6 @@
 #include "extensions/access_loggers/file/config.h"
 
 #include <memory>
-#include <unordered_map>
 
 #include "envoy/extensions/access_loggers/file/v3/file.pb.h"
 #include "envoy/extensions/access_loggers/file/v3/file.pb.validate.h"
diff --git a/source/extensions/access_loggers/grpc/grpc_access_log_impl.h b/source/extensions/access_loggers/grpc/grpc_access_log_impl.h
index 5cf04837c49b..2fe0d112d6f6 100644
--- a/source/extensions/access_loggers/grpc/grpc_access_log_impl.h
+++ b/source/extensions/access_loggers/grpc/grpc_access_log_impl.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <memory>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/data/accesslog/v3/accesslog.pb.h"
diff --git a/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h b/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h
index 0d6ec73ac0fd..fcae58bd5f10 100644
--- a/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h
+++ b/source/extensions/access_loggers/grpc/http_grpc_access_log_impl.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <memory>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/extensions/access_loggers/grpc/v3/als.pb.h"
diff --git a/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h b/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h
index 7a7260df7248..cf424bb92a3d 100644
--- a/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h
+++ b/source/extensions/access_loggers/grpc/tcp_grpc_access_log_impl.h
@@ -1,6 +1,5 @@
 #pragma once
 
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/extensions/access_loggers/grpc/v3/als.pb.h"
diff --git a/source/extensions/clusters/redis/redis_cluster.cc b/source/extensions/clusters/redis/redis_cluster.cc
index e4a07f005082..db5f04d91807 100644
--- a/source/extensions/clusters/redis/redis_cluster.cc
+++ b/source/extensions/clusters/redis/redis_cluster.cc
@@ -102,7 +102,7 @@ void RedisCluster::onClusterSlotUpdate(ClusterSlotsPtr&& slots) {
     }
   }
 
-  std::unordered_map<std::string, Upstream::HostSharedPtr> updated_hosts;
+  absl::node_hash_map<std::string, Upstream::HostSharedPtr> updated_hosts;
   Upstream::HostVector hosts_added;
   Upstream::HostVector hosts_removed;
   const bool host_updated = updateDynamicHostList(new_hosts, hosts_, hosts_added, hosts_removed,
diff --git a/source/extensions/clusters/redis/redis_cluster.h b/source/extensions/clusters/redis/redis_cluster.h
index a3e4574c7032..b3d842aa19de 100644
--- a/source/extensions/clusters/redis/redis_cluster.h
+++ b/source/extensions/clusters/redis/redis_cluster.h
@@ -247,7 +247,7 @@ class RedisCluster : public Upstream::BaseDynamicClusterImpl {
     Event::Dispatcher& dispatcher_;
     std::string current_host_address_;
     Extensions::NetworkFilters::Common::Redis::Client::PoolRequest* current_request_{};
-    std::unordered_map<std::string, RedisDiscoveryClientPtr> client_map_;
+    absl::node_hash_map<std::string, RedisDiscoveryClientPtr> client_map_;
 
     std::list<Network::Address::InstanceConstSharedPtr> discovery_address_list_;
 
diff --git a/source/extensions/common/tap/admin.h b/source/extensions/common/tap/admin.h
index c876e9f7fd76..bf80f6889b17 100644
--- a/source/extensions/common/tap/admin.h
+++ b/source/extensions/common/tap/admin.h
@@ -6,6 +6,8 @@
 
 #include "extensions/common/tap/tap.h"
 
+#include "absl/container/node_hash_set.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace Common {
@@ -80,7 +82,7 @@ class AdminHandler : public Singleton::Instance,
 
   Server::Admin& admin_;
   Event::Dispatcher& main_thread_dispatcher_;
-  std::unordered_map<std::string, std::unordered_set<ExtensionConfig*>> config_id_map_;
+  absl::node_hash_map<std::string, absl::node_hash_set<ExtensionConfig*>> config_id_map_;
   absl::optional<const AttachedRequest> attached_request_;
 };
 
diff --git a/source/extensions/common/utility.h b/source/extensions/common/utility.h
index 309dca2e2107..60336fe5e444 100644
--- a/source/extensions/common/utility.h
+++ b/source/extensions/common/utility.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unordered_map>
-
 #include "envoy/common/exception.h"
 #include "envoy/runtime/runtime.h"
 
diff --git a/source/extensions/filters/http/common/utility.h b/source/extensions/filters/http/common/utility.h
index 23915b30f4df..b119e2db12b5 100644
--- a/source/extensions/filters/http/common/utility.h
+++ b/source/extensions/filters/http/common/utility.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unordered_map>
-
 #include "common/common/macros.h"
 
 #include "extensions/common/utility.h"
diff --git a/source/extensions/filters/http/fault/fault_filter.h b/source/extensions/filters/http/fault/fault_filter.h
index 2dfed7c9167d..206a8134c72c 100644
--- a/source/extensions/filters/http/fault/fault_filter.h
+++ b/source/extensions/filters/http/fault/fault_filter.h
@@ -3,7 +3,6 @@
 #include <cstdint>
 #include <memory>
 #include <string>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/extensions/filters/http/fault/v3/fault.pb.h"
diff --git a/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc b/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc
index 222b9dbf00fb..e2998a3f5866 100644
--- a/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc
+++ b/source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc
@@ -146,7 +146,11 @@ JsonTranscoderConfig::JsonTranscoderConfig(
                                                        &descriptor_pool_));
 
   PathMatcherBuilder<MethodInfoSharedPtr> pmb;
+  // clang-format off
+  // We cannot convert this to a absl hash set as PathMatcherUtility::RegisterByHttpRule takes a
+  // std::unordered_set as an argument
   std::unordered_set<std::string> ignored_query_parameters;
+  // clang-format on
   for (const auto& query_param : proto_config.ignored_query_parameters()) {
     ignored_query_parameters.insert(query_param);
   }
diff --git a/source/extensions/filters/http/grpc_web/grpc_web_filter.h b/source/extensions/filters/http/grpc_web/grpc_web_filter.h
index 7dfd54d51f48..2ae3d2381fbf 100644
--- a/source/extensions/filters/http/grpc_web/grpc_web_filter.h
+++ b/source/extensions/filters/http/grpc_web/grpc_web_filter.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unordered_set>
-
 #include "envoy/http/filter.h"
 #include "envoy/upstream/cluster_manager.h"
 
diff --git a/source/extensions/filters/http/jwt_authn/extractor.cc b/source/extensions/filters/http/jwt_authn/extractor.cc
index 338187e6a139..b84f9fb4178f 100644
--- a/source/extensions/filters/http/jwt_authn/extractor.cc
+++ b/source/extensions/filters/http/jwt_authn/extractor.cc
@@ -9,6 +9,7 @@
 #include "common/http/utility.h"
 #include "common/singleton/const_singleton.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/match.h"
 
 using envoy::extensions::filters::http::jwt_authn::v3::JwtProvider;
@@ -35,7 +36,7 @@ using JwtConstValues = ConstSingleton<JwtConstValueStruct>;
 // A base JwtLocation object to store token and specified_issuers.
 class JwtLocationBase : public JwtLocation {
 public:
-  JwtLocationBase(const std::string& token, const std::unordered_set<std::string>& issuers)
+  JwtLocationBase(const std::string& token, const absl::node_hash_set<std::string>& issuers)
       : token_(token), specified_issuers_(issuers) {}
 
   // Get the token string
@@ -50,13 +51,13 @@ class JwtLocationBase : public JwtLocation {
   // Extracted token.
   const std::string token_;
   // Stored issuers specified the location.
-  const std::unordered_set<std::string>& specified_issuers_;
+  const absl::node_hash_set<std::string>& specified_issuers_;
 };
 
 // The JwtLocation for header extraction.
 class JwtHeaderLocation : public JwtLocationBase {
 public:
-  JwtHeaderLocation(const std::string& token, const std::unordered_set<std::string>& issuers,
+  JwtHeaderLocation(const std::string& token, const absl::node_hash_set<std::string>& issuers,
                     const LowerCaseString& header)
       : JwtLocationBase(token, issuers), header_(header) {}
 
@@ -70,7 +71,7 @@ class JwtHeaderLocation : public JwtLocationBase {
 // The JwtLocation for param extraction.
 class JwtParamLocation : public JwtLocationBase {
 public:
-  JwtParamLocation(const std::string& token, const std::unordered_set<std::string>& issuers,
+  JwtParamLocation(const std::string& token, const absl::node_hash_set<std::string>& issuers,
                    const std::string&)
       : JwtLocationBase(token, issuers) {}
 
@@ -118,7 +119,7 @@ class ExtractorImpl : public Logger::Loggable<Logger::Id::jwt>, public Extractor
     // The value prefix. e.g. for "Bearer <token>", the value_prefix is "Bearer ".
     std::string value_prefix_;
     // Issuers that specified this header.
-    std::unordered_set<std::string> specified_issuers_;
+    absl::node_hash_set<std::string> specified_issuers_;
   };
   using HeaderLocationSpecPtr = std::unique_ptr<HeaderLocationSpec>;
   // The map of (header + value_prefix) to HeaderLocationSpecPtr
@@ -127,7 +128,7 @@ class ExtractorImpl : public Logger::Loggable<Logger::Id::jwt>, public Extractor
   // ParamMap value type to store issuers that specified this header.
   struct ParamLocationSpec {
     // Issuers that specified this param.
-    std::unordered_set<std::string> specified_issuers_;
+    absl::node_hash_set<std::string> specified_issuers_;
   };
   // The map of a parameter key to set of issuers specified the parameter
   std::map<std::string, ParamLocationSpec> param_locations_;
diff --git a/source/extensions/filters/http/jwt_authn/extractor.h b/source/extensions/filters/http/jwt_authn/extractor.h
index 83255f9a2982..8be7d9b830ca 100644
--- a/source/extensions/filters/http/jwt_authn/extractor.h
+++ b/source/extensions/filters/http/jwt_authn/extractor.h
@@ -2,7 +2,6 @@
 
 #include <map>
 #include <string>
-#include <unordered_set>
 
 #include "envoy/extensions/filters/http/jwt_authn/v3/config.pb.h"
 #include "envoy/http/header_map.h"
diff --git a/source/extensions/filters/http/jwt_authn/jwks_cache.cc b/source/extensions/filters/http/jwt_authn/jwks_cache.cc
index 9c7034c08d0b..a6020ad9c055 100644
--- a/source/extensions/filters/http/jwt_authn/jwks_cache.cc
+++ b/source/extensions/filters/http/jwt_authn/jwks_cache.cc
@@ -1,7 +1,6 @@
 #include "extensions/filters/http/jwt_authn/jwks_cache.h"
 
 #include <chrono>
-#include <unordered_map>
 
 #include "envoy/common/time.h"
 #include "envoy/extensions/filters/http/jwt_authn/v3/config.pb.h"
@@ -10,6 +9,7 @@
 #include "common/config/datasource.h"
 #include "common/protobuf/utility.h"
 
+#include "absl/container/node_hash_map.h"
 #include "jwt_verify_lib/check_audience.h"
 
 using envoy::extensions::filters::http::jwt_authn::v3::JwtAuthentication;
@@ -125,9 +125,9 @@ class JwksCacheImpl : public JwksCache {
 
 private:
   // The Jwks data map indexed by provider.
-  std::unordered_map<std::string, JwksDataImpl> jwks_data_map_;
+  absl::node_hash_map<std::string, JwksDataImpl> jwks_data_map_;
   // The Jwks data pointer map indexed by issuer.
-  std::unordered_map<std::string, JwksData*> issuer_ptr_map_;
+  absl::node_hash_map<std::string, JwksData*> issuer_ptr_map_;
 };
 
 } // namespace
diff --git a/source/extensions/filters/http/jwt_authn/verifier.cc b/source/extensions/filters/http/jwt_authn/verifier.cc
index 138a50e95a9d..e8b613911e8d 100644
--- a/source/extensions/filters/http/jwt_authn/verifier.cc
+++ b/source/extensions/filters/http/jwt_authn/verifier.cc
@@ -70,7 +70,7 @@ class ContextImpl : public Verifier::Context {
   Http::RequestHeaderMap& headers_;
   Tracing::Span& parent_span_;
   Verifier::Callbacks* callback_;
-  std::unordered_map<const Verifier*, CompletionState> completion_states_;
+  absl::node_hash_map<const Verifier*, CompletionState> completion_states_;
   std::vector<AuthenticatorPtr> auths_;
   ProtobufWkt::Struct payload_;
 };
diff --git a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
index e5d1bf793706..53422e5f48d8 100644
--- a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
+++ b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
@@ -3,7 +3,6 @@
 #include <cstdint>
 #include <memory>
 #include <string>
-#include <unordered_set>
 
 #include "envoy/common/random_generator.h"
 #include "envoy/config/subscription.h"
@@ -19,6 +18,8 @@
 #include "common/network/utility.h"
 #include "common/protobuf/utility.h"
 
+#include "absl/container/node_hash_set.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace NetworkFilters {
@@ -59,7 +60,7 @@ class AllowedPrincipals : public ThreadLocal::ThreadLocalObject {
   size_t size() const { return allowed_sha256_digests_.size(); }
 
 private:
-  std::unordered_set<std::string> allowed_sha256_digests_;
+  absl::node_hash_set<std::string> allowed_sha256_digests_;
 };
 
 using AllowedPrincipalsSharedPtr = std::shared_ptr<AllowedPrincipals>;
diff --git a/source/extensions/filters/network/common/utility.h b/source/extensions/filters/network/common/utility.h
index 8c499cf1eb49..54a458aa7b62 100644
--- a/source/extensions/filters/network/common/utility.h
+++ b/source/extensions/filters/network/common/utility.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unordered_map>
-
 #include "common/common/macros.h"
 
 #include "extensions/common/utility.h"
diff --git a/source/extensions/filters/network/dubbo_proxy/message.h b/source/extensions/filters/network/dubbo_proxy/message.h
index 19a1f91d90d9..08a399fae8b7 100644
--- a/source/extensions/filters/network/dubbo_proxy/message.h
+++ b/source/extensions/filters/network/dubbo_proxy/message.h
@@ -7,6 +7,7 @@
 
 #include "common/buffer/buffer_impl.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/types/optional.h"
 
 namespace Envoy {
@@ -88,7 +89,7 @@ enum class RpcResponseType : uint8_t {
 
 class Context {
 public:
-  using AttachmentMap = std::unordered_map<std::string, std::string>;
+  using AttachmentMap = absl::node_hash_map<std::string, std::string>;
 
   bool hasAttachments() const { return !attachments_.empty(); }
   const AttachmentMap& attachments() const { return attachments_; }
diff --git a/source/extensions/filters/network/dubbo_proxy/metadata.h b/source/extensions/filters/network/dubbo_proxy/metadata.h
index 5f0037ca6ae3..698b50283ec6 100644
--- a/source/extensions/filters/network/dubbo_proxy/metadata.h
+++ b/source/extensions/filters/network/dubbo_proxy/metadata.h
@@ -2,7 +2,6 @@
 
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "common/common/assert.h"
 #include "common/common/empty_string.h"
diff --git a/source/extensions/filters/network/dubbo_proxy/protocol.h b/source/extensions/filters/network/dubbo_proxy/protocol.h
index b496699d42c2..09f16d4420da 100644
--- a/source/extensions/filters/network/dubbo_proxy/protocol.h
+++ b/source/extensions/filters/network/dubbo_proxy/protocol.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 
 #include "envoy/buffer/buffer.h"
 #include "envoy/config/typed_config.h"
diff --git a/source/extensions/filters/network/dubbo_proxy/protocol_constants.h b/source/extensions/filters/network/dubbo_proxy/protocol_constants.h
index 138905d22c1e..e7b787831e37 100644
--- a/source/extensions/filters/network/dubbo_proxy/protocol_constants.h
+++ b/source/extensions/filters/network/dubbo_proxy/protocol_constants.h
@@ -1,13 +1,13 @@
 #pragma once
 
-#include <unordered_map>
-
 #include "common/common/assert.h"
 #include "common/common/fmt.h"
 #include "common/singleton/const_singleton.h"
 
 #include "extensions/filters/network/dubbo_proxy/message.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace NetworkFilters {
@@ -22,7 +22,7 @@ class ProtocolNameValues {
     template <typename T> std::size_t operator()(T t) const { return static_cast<std::size_t>(t); }
   };
 
-  using ProtocolTypeNameMap = std::unordered_map<ProtocolType, std::string, ProtocolTypeHash>;
+  using ProtocolTypeNameMap = absl::node_hash_map<ProtocolType, std::string, ProtocolTypeHash>;
 
   const ProtocolTypeNameMap protocolTypeNameMap = {
       {ProtocolType::Dubbo, "dubbo"},
@@ -47,7 +47,7 @@ class SerializerNameValues {
   };
 
   using SerializerTypeNameMap =
-      std::unordered_map<SerializationType, std::string, SerializationTypeHash>;
+      absl::node_hash_map<SerializationType, std::string, SerializationTypeHash>;
 
   const SerializerTypeNameMap serializerTypeNameMap = {
       {SerializationType::Hessian2, "hessian2"},
@@ -77,7 +77,7 @@ class ProtocolSerializerNameValues {
 
 #define GENERATE_PAIR(X, Y) generateKey(X, Y), generateValue(X, Y)
 
-  using ProtocolSerializerTypeNameMap = std::unordered_map<uint8_t, std::string>;
+  using ProtocolSerializerTypeNameMap = absl::node_hash_map<uint8_t, std::string>;
 
   const ProtocolSerializerTypeNameMap protocolSerializerTypeNameMap = {
       {GENERATE_PAIR(ProtocolType::Dubbo, SerializationType::Hessian2)},
diff --git a/source/extensions/filters/network/dubbo_proxy/router/route.h b/source/extensions/filters/network/dubbo_proxy/router/route.h
index c9814aa18f2a..247cdf480f16 100644
--- a/source/extensions/filters/network/dubbo_proxy/router/route.h
+++ b/source/extensions/filters/network/dubbo_proxy/router/route.h
@@ -37,7 +37,7 @@ class RouteMatcherNameValues {
   };
 
   using RouteMatcherNameMap =
-      std::unordered_map<RouteMatcherType, std::string, RouteMatcherTypeHash>;
+      absl::node_hash_map<RouteMatcherType, std::string, RouteMatcherTypeHash>;
 
   const RouteMatcherNameMap routeMatcherNameMap = {
       {RouteMatcherType::Default, "default"},
diff --git a/source/extensions/filters/network/dubbo_proxy/serializer.h b/source/extensions/filters/network/dubbo_proxy/serializer.h
index 2d3c1125cb7f..8b12ccd43dc4 100644
--- a/source/extensions/filters/network/dubbo_proxy/serializer.h
+++ b/source/extensions/filters/network/dubbo_proxy/serializer.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 
 #include "envoy/buffer/buffer.h"
 #include "envoy/config/typed_config.h"
diff --git a/source/extensions/filters/network/dubbo_proxy/serializer_impl.h b/source/extensions/filters/network/dubbo_proxy/serializer_impl.h
index cec6ac1a0252..1c9bcd7ccf0b 100644
--- a/source/extensions/filters/network/dubbo_proxy/serializer_impl.h
+++ b/source/extensions/filters/network/dubbo_proxy/serializer_impl.h
@@ -11,7 +11,7 @@ namespace DubboProxy {
 class RpcInvocationImpl : public RpcInvocationBase {
 public:
   // TODO(gengleilei) Add parameter data types and implement Dubbo data type mapping.
-  using ParameterValueMap = std::unordered_map<uint32_t, std::string>;
+  using ParameterValueMap = absl::node_hash_map<uint32_t, std::string>;
   using ParameterValueMapPtr = std::unique_ptr<ParameterValueMap>;
 
   RpcInvocationImpl() = default;
diff --git a/source/extensions/filters/network/redis_proxy/command_splitter_impl.h b/source/extensions/filters/network/redis_proxy/command_splitter_impl.h
index 813597dc0d2a..630bbcb71503 100644
--- a/source/extensions/filters/network/redis_proxy/command_splitter_impl.h
+++ b/source/extensions/filters/network/redis_proxy/command_splitter_impl.h
@@ -2,7 +2,6 @@
 
 #include <cstdint>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/stats/scope.h"
diff --git a/source/extensions/filters/network/redis_proxy/conn_pool_impl.h b/source/extensions/filters/network/redis_proxy/conn_pool_impl.h
index aaa25c238510..2a6c643cfeed 100644
--- a/source/extensions/filters/network/redis_proxy/conn_pool_impl.h
+++ b/source/extensions/filters/network/redis_proxy/conn_pool_impl.h
@@ -5,7 +5,6 @@
 #include <list>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.pb.h"
@@ -30,6 +29,8 @@
 #include "extensions/filters/network/common/redis/utility.h"
 #include "extensions/filters/network/redis_proxy/conn_pool.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace NetworkFilters {
@@ -154,9 +155,9 @@ class InstanceImpl : public Instance, public std::enable_shared_from_this<Instan
     const std::string cluster_name_;
     Upstream::ClusterUpdateCallbacksHandlePtr cluster_update_handle_;
     Upstream::ThreadLocalCluster* cluster_{};
-    std::unordered_map<Upstream::HostConstSharedPtr, ThreadLocalActiveClientPtr> client_map_;
+    absl::node_hash_map<Upstream::HostConstSharedPtr, ThreadLocalActiveClientPtr> client_map_;
     Envoy::Common::CallbackHandle* host_set_member_update_cb_handle_{};
-    std::unordered_map<std::string, Upstream::HostConstSharedPtr> host_address_map_;
+    absl::node_hash_map<std::string, Upstream::HostConstSharedPtr> host_address_map_;
     std::string auth_username_;
     std::string auth_password_;
     std::list<Upstream::HostSharedPtr> created_via_redirect_hosts_;
diff --git a/source/extensions/filters/network/rocketmq_proxy/active_message.cc b/source/extensions/filters/network/rocketmq_proxy/active_message.cc
index c9e3bd14c2c3..3f38565da684 100644
--- a/source/extensions/filters/network/rocketmq_proxy/active_message.cc
+++ b/source/extensions/filters/network/rocketmq_proxy/active_message.cc
@@ -134,7 +134,7 @@ void ActiveMessage::fillBrokerData(std::vector<BrokerData>& list, const std::str
   }
 
   if (!found) {
-    std::unordered_map<int64_t, std::string> addresses;
+    absl::node_hash_map<int64_t, std::string> addresses;
     addresses.emplace(broker_id, address);
 
     list.emplace_back(BrokerData(cluster, broker_name, std::move(addresses)));
diff --git a/source/extensions/filters/network/rocketmq_proxy/topic_route.h b/source/extensions/filters/network/rocketmq_proxy/topic_route.h
index 2b9afdb1d526..f6c1bc9eba19 100644
--- a/source/extensions/filters/network/rocketmq_proxy/topic_route.h
+++ b/source/extensions/filters/network/rocketmq_proxy/topic_route.h
@@ -1,11 +1,12 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "common/protobuf/utility.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace NetworkFilters {
@@ -37,7 +38,7 @@ class QueueData {
 class BrokerData {
 public:
   BrokerData(const std::string& cluster, const std::string& broker_name,
-             std::unordered_map<int64_t, std::string>&& broker_addrs)
+             absl::node_hash_map<int64_t, std::string>&& broker_addrs)
       : cluster_(cluster), broker_name_(broker_name), broker_addrs_(broker_addrs) {}
 
   void encode(ProtobufWkt::Struct& data_struct);
@@ -46,12 +47,12 @@ class BrokerData {
 
   const std::string& brokerName() const { return broker_name_; }
 
-  std::unordered_map<int64_t, std::string>& brokerAddresses() { return broker_addrs_; }
+  absl::node_hash_map<int64_t, std::string>& brokerAddresses() { return broker_addrs_; }
 
 private:
   std::string cluster_;
   std::string broker_name_;
-  std::unordered_map<int64_t, std::string> broker_addrs_;
+  absl::node_hash_map<int64_t, std::string> broker_addrs_;
 };
 
 class TopicRouteData {
diff --git a/source/extensions/filters/network/thrift_proxy/decoder.cc b/source/extensions/filters/network/thrift_proxy/decoder.cc
index c02a4b1dc062..73a12ff23377 100644
--- a/source/extensions/filters/network/thrift_proxy/decoder.cc
+++ b/source/extensions/filters/network/thrift_proxy/decoder.cc
@@ -1,7 +1,5 @@
 #include "extensions/filters/network/thrift_proxy/decoder.h"
 
-#include <unordered_map>
-
 #include "envoy/common/exception.h"
 
 #include "common/common/assert.h"
diff --git a/source/extensions/filters/network/zookeeper_proxy/decoder.h b/source/extensions/filters/network/zookeeper_proxy/decoder.h
index 6492f2179f5c..85b99fdffbf7 100644
--- a/source/extensions/filters/network/zookeeper_proxy/decoder.h
+++ b/source/extensions/filters/network/zookeeper_proxy/decoder.h
@@ -10,6 +10,8 @@
 
 #include "extensions/filters/network/zookeeper_proxy/utils.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace NetworkFilters {
@@ -169,7 +171,7 @@ class DecoderImpl : public Decoder, Logger::Loggable<Logger::Id::filter> {
   const uint32_t max_packet_bytes_;
   BufferHelper helper_;
   TimeSource& time_source_;
-  std::unordered_map<int32_t, RequestBegin> requests_by_xid_;
+  absl::node_hash_map<int32_t, RequestBegin> requests_by_xid_;
 };
 
 } // namespace ZooKeeperProxy
diff --git a/source/extensions/quic_listeners/quiche/platform/quiche_unordered_containers_impl.h b/source/extensions/quic_listeners/quiche/platform/quiche_unordered_containers_impl.h
index 508efe2ee01f..f3e4130b01ff 100644
--- a/source/extensions/quic_listeners/quiche/platform/quiche_unordered_containers_impl.h
+++ b/source/extensions/quic_listeners/quiche/platform/quiche_unordered_containers_impl.h
@@ -14,7 +14,7 @@ namespace quiche {
 // The default hasher used by hash tables.
 template <typename Key> using QuicheDefaultHasherImpl = absl::Hash<Key>;
 
-// Similar to std::unordered_map, but with better performance and memory usage.
+// Similar to absl::node_hash_map, but with better performance and memory usage.
 template <typename Key, typename Value, typename Hash, typename Eq>
 using QuicheUnorderedMapImpl = absl::node_hash_map<Key, Value, Hash, Eq>;
 
diff --git a/source/extensions/stat_sinks/hystrix/hystrix.cc b/source/extensions/stat_sinks/hystrix/hystrix.cc
index 82eb9906612b..a35f67a8d3f7 100644
--- a/source/extensions/stat_sinks/hystrix/hystrix.cc
+++ b/source/extensions/stat_sinks/hystrix/hystrix.cc
@@ -342,7 +342,7 @@ void HystrixSink::flush(Stats::MetricSnapshot& snapshot) {
   Upstream::ClusterManager::ClusterInfoMap clusters = server_.clusterManager().clusters();
 
   // Save a map of the relevant histograms per cluster in a convenient format.
-  std::unordered_map<std::string, QuantileLatencyMap> time_histograms;
+  absl::node_hash_map<std::string, QuantileLatencyMap> time_histograms;
   for (const auto& histogram : snapshot.histograms()) {
     if (histogram.get().tagExtractedStatName() == cluster_upstream_rq_time_) {
       absl::optional<Stats::StatName> value =
@@ -410,7 +410,9 @@ void HystrixSink::flush(Stats::MetricSnapshot& snapshot) {
   if (clusters.size() < cluster_stats_cache_map_.size()) {
     for (auto it = cluster_stats_cache_map_.begin(); it != cluster_stats_cache_map_.end();) {
       if (clusters.find(it->first) == clusters.end()) {
-        it = cluster_stats_cache_map_.erase(it);
+        auto next_it = std::next(it);
+        cluster_stats_cache_map_.erase(it);
+        it = next_it;
       } else {
         ++it;
       }
diff --git a/source/extensions/stat_sinks/hystrix/hystrix.h b/source/extensions/stat_sinks/hystrix/hystrix.h
index 70185e5730bd..796e72d1f97a 100644
--- a/source/extensions/stat_sinks/hystrix/hystrix.h
+++ b/source/extensions/stat_sinks/hystrix/hystrix.h
@@ -19,7 +19,7 @@ namespace Hystrix {
 using RollingWindow = std::vector<uint64_t>;
 using RollingStatsMap = std::map<const std::string, RollingWindow>;
 
-using QuantileLatencyMap = std::unordered_map<double, double>;
+using QuantileLatencyMap = absl::node_hash_map<double, double>;
 static const std::vector<double> hystrix_quantiles = {0,    0.25, 0.5,   0.75, 0.90,
                                                       0.95, 0.99, 0.995, 1};
 
@@ -155,7 +155,7 @@ class HystrixSink : public Stats::Sink, public Logger::Loggable<Logger::Id::hyst
   static const uint64_t DEFAULT_NUM_BUCKETS = 10;
 
   // Map from cluster names to a struct of all of that cluster's stat windows.
-  std::unordered_map<std::string, ClusterStatsCachePtr> cluster_stats_cache_map_;
+  absl::node_hash_map<std::string, ClusterStatsCachePtr> cluster_stats_cache_map_;
 
   // Saved StatNames for fast comparisons in loop.
   // TODO(mattklein123): Many/all of these stats should just be pulled directly from the cluster
diff --git a/source/extensions/transport_sockets/alts/BUILD b/source/extensions/transport_sockets/alts/BUILD
index 5145a1abdb1d..a667fac37e14 100644
--- a/source/extensions/transport_sockets/alts/BUILD
+++ b/source/extensions/transport_sockets/alts/BUILD
@@ -34,6 +34,9 @@ envoy_cc_extension(
     hdrs = [
         "config.h",
     ],
+    external_deps = [
+        "abseil_node_hash_set",
+    ],
     security_posture = "robust_to_untrusted_downstream_and_upstream",
     deps = [
         ":tsi_handshaker",
diff --git a/source/extensions/transport_sockets/alts/config.cc b/source/extensions/transport_sockets/alts/config.cc
index c45e7f0a9ee1..1d8b60eab386 100644
--- a/source/extensions/transport_sockets/alts/config.cc
+++ b/source/extensions/transport_sockets/alts/config.cc
@@ -13,6 +13,7 @@
 #include "extensions/transport_sockets/alts/grpc_tsi.h"
 #include "extensions/transport_sockets/alts/tsi_socket.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/str_join.h"
 
 namespace Envoy {
@@ -37,7 +38,7 @@ void grpcAltsSetRpcProtocolVersions(grpc_gcp_rpc_protocol_versions* rpc_versions
 
 // Returns true if the peer's service account is found in peers, otherwise
 // returns false and fills out err with an error message.
-bool doValidate(const tsi_peer& peer, const std::unordered_set<std::string>& peers,
+bool doValidate(const tsi_peer& peer, const absl::node_hash_set<std::string>& peers,
                 std::string& err) {
   for (size_t i = 0; i < peer.property_count; ++i) {
     const std::string name = std::string(peer.properties[i].name);
@@ -57,8 +58,8 @@ bool doValidate(const tsi_peer& peer, const std::unordered_set<std::string>& pee
 HandshakeValidator
 createHandshakeValidator(const envoy::extensions::transport_sockets::alts::v3::Alts& config) {
   const auto& peer_service_accounts = config.peer_service_accounts();
-  const std::unordered_set<std::string> peers(peer_service_accounts.cbegin(),
-                                              peer_service_accounts.cend());
+  const absl::node_hash_set<std::string> peers(peer_service_accounts.cbegin(),
+                                               peer_service_accounts.cend());
   HandshakeValidator validator;
   // Skip validation if peers is empty.
   if (!peers.empty()) {
diff --git a/source/extensions/transport_sockets/tls/BUILD b/source/extensions/transport_sockets/tls/BUILD
index b26ce0cc4d14..6b14b5b0a870 100644
--- a/source/extensions/transport_sockets/tls/BUILD
+++ b/source/extensions/transport_sockets/tls/BUILD
@@ -91,6 +91,7 @@ envoy_cc_library(
         "context_manager_impl.h",
     ],
     external_deps = [
+        "abseil_node_hash_set",
         "abseil_synchronization",
         "ssl",
     ],
diff --git a/source/extensions/transport_sockets/tls/context_impl.cc b/source/extensions/transport_sockets/tls/context_impl.cc
index f42f9077fc42..369bdd460f98 100644
--- a/source/extensions/transport_sockets/tls/context_impl.cc
+++ b/source/extensions/transport_sockets/tls/context_impl.cc
@@ -24,6 +24,7 @@
 
 #include "extensions/transport_sockets/tls/utility.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_join.h"
 #include "openssl/evp.h"
@@ -268,7 +269,7 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
     }
   }
 
-  std::unordered_set<int> cert_pkey_ids;
+  absl::node_hash_set<int> cert_pkey_ids;
   for (uint32_t i = 0; i < tls_certificates.size(); ++i) {
     auto& ctx = tls_contexts_[i];
     // Load certificate chain.
diff --git a/source/server/admin/admin.cc b/source/server/admin/admin.cc
index 227f0a92277e..7745860a1c9d 100644
--- a/source/server/admin/admin.cc
+++ b/source/server/admin/admin.cc
@@ -4,7 +4,6 @@
 #include <cstdint>
 #include <fstream>
 #include <string>
-#include <unordered_set>
 #include <utility>
 #include <vector>
 
diff --git a/source/server/admin/admin.h b/source/server/admin/admin.h
index 4cf81cba4f9e..093ed76e4156 100644
--- a/source/server/admin/admin.h
+++ b/source/server/admin/admin.h
@@ -4,7 +4,6 @@
 #include <functional>
 #include <list>
 #include <string>
-#include <unordered_map>
 #include <utility>
 #include <vector>
 
diff --git a/source/server/admin/runtime_handler.cc b/source/server/admin/runtime_handler.cc
index 869427f694b8..5719f4ac730e 100644
--- a/source/server/admin/runtime_handler.cc
+++ b/source/server/admin/runtime_handler.cc
@@ -1,7 +1,6 @@
 #include "server/admin/runtime_handler.h"
 
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "common/common/empty_string.h"
@@ -10,6 +9,8 @@
 
 #include "server/admin/utils.h"
 
+#include "absl/container/node_hash_map.h"
+
 namespace Envoy {
 namespace Server {
 
@@ -96,7 +97,7 @@ Http::Code RuntimeHandler::handlerRuntimeModify(absl::string_view url, Http::Res
       return Http::Code::BadRequest;
     }
   }
-  std::unordered_map<std::string, std::string> overrides;
+  absl::node_hash_map<std::string, std::string> overrides;
   overrides.insert(params.begin(), params.end());
   try {
     server_.runtime().mergeValues(overrides);
diff --git a/source/server/configuration_impl.h b/source/server/configuration_impl.h
index becb15a39745..d1c88000c1d1 100644
--- a/source/server/configuration_impl.h
+++ b/source/server/configuration_impl.h
@@ -6,7 +6,6 @@
 #include <list>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <utility>
 
 #include "envoy/config/bootstrap/v3/bootstrap.pb.h"
diff --git a/source/server/connection_handler_impl.cc b/source/server/connection_handler_impl.cc
index 3d2a38928dad..5aaf9b7708c0 100644
--- a/source/server/connection_handler_impl.cc
+++ b/source/server/connection_handler_impl.cc
@@ -453,7 +453,7 @@ void ConnectionHandlerImpl::ActiveTcpListener::deferredRemoveFilterChains(
       // Since is_deleting_ is on, we need to manually remove the map value and drive the iterator.
       // Defer delete connection container to avoid race condition in destroying connection.
       parent_.dispatcher_.deferredDelete(std::move(iter->second));
-      iter = connections_by_context_.erase(iter);
+      connections_by_context_.erase(iter);
     }
   }
   is_deleting_ = was_deleting;
diff --git a/source/server/connection_handler_impl.h b/source/server/connection_handler_impl.h
index df6fa758bd5b..4fe28847be48 100644
--- a/source/server/connection_handler_impl.h
+++ b/source/server/connection_handler_impl.h
@@ -181,7 +181,7 @@ class ConnectionHandlerImpl : public Network::ConnectionHandler,
     const std::chrono::milliseconds listener_filters_timeout_;
     const bool continue_on_listener_filters_timeout_;
     std::list<ActiveTcpSocketPtr> sockets_;
-    std::unordered_map<const Network::FilterChain*, ActiveConnectionsPtr> connections_by_context_;
+    absl::node_hash_map<const Network::FilterChain*, ActiveConnectionsPtr> connections_by_context_;
 
     // The number of connections currently active on this listener. This is typically used for
     // connection balancing across per-handler listeners.
diff --git a/source/server/filter_chain_manager_impl.cc b/source/server/filter_chain_manager_impl.cc
index 00f71743fa5b..3e1169c17531 100644
--- a/source/server/filter_chain_manager_impl.cc
+++ b/source/server/filter_chain_manager_impl.cc
@@ -11,6 +11,7 @@
 
 #include "server/configuration_impl.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 
@@ -149,7 +150,7 @@ void FilterChainManagerImpl::addFilterChain(
     FilterChainFactoryBuilder& filter_chain_factory_builder,
     FilterChainFactoryContextCreator& context_creator) {
   Cleanup cleanup([this]() { origin_ = absl::nullopt; });
-  std::unordered_set<envoy::config::listener::v3::FilterChainMatch, MessageUtil, MessageUtil>
+  absl::node_hash_set<envoy::config::listener::v3::FilterChainMatch, MessageUtil, MessageUtil>
       filter_chains;
   uint32_t new_filter_chain_size = 0;
   for (const auto& filter_chain : filter_chain_span) {
diff --git a/source/server/lds_api.cc b/source/server/lds_api.cc
index fc6ced5853ee..3165a1525ce6 100644
--- a/source/server/lds_api.cc
+++ b/source/server/lds_api.cc
@@ -1,7 +1,5 @@
 #include "server/lds_api.h"
 
-#include <unordered_map>
-
 #include "envoy/admin/v3/config_dump.pb.h"
 #include "envoy/api/v2/listener.pb.h"
 #include "envoy/config/core/v3/config_source.pb.h"
@@ -15,6 +13,7 @@
 #include "common/config/utility.h"
 #include "common/protobuf/utility.h"
 
+#include "absl/container/node_hash_set.h"
 #include "absl/strings/str_join.h"
 
 namespace Envoy {
@@ -57,7 +56,7 @@ void LdsApiImpl::onConfigUpdate(const std::vector<Config::DecodedResourceRef>& a
   }
 
   ListenerManager::FailureStates failure_state;
-  std::unordered_set<std::string> listener_names;
+  absl::node_hash_set<std::string> listener_names;
   std::string message;
   for (const auto& resource : added_resources) {
     envoy::config::listener::v3::Listener listener;
@@ -97,7 +96,7 @@ void LdsApiImpl::onConfigUpdate(const std::vector<Config::DecodedResourceRef>& r
                                 const std::string& version_info) {
   // We need to keep track of which listeners need to remove.
   // Specifically, it's [listeners we currently have] - [listeners found in the response].
-  std::unordered_set<std::string> listeners_to_remove;
+  absl::node_hash_set<std::string> listeners_to_remove;
   for (const auto& listener : listener_manager_.listeners()) {
     listeners_to_remove.insert(listener.get().name());
   }
diff --git a/source/server/overload_manager_impl.cc b/source/server/overload_manager_impl.cc
index 40156ed9b179..1e4e085bb890 100644
--- a/source/server/overload_manager_impl.cc
+++ b/source/server/overload_manager_impl.cc
@@ -10,6 +10,7 @@
 
 #include "server/resource_monitor_config_impl.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/str_cat.h"
 
 namespace Envoy {
@@ -51,7 +52,7 @@ class ThreadLocalOverloadStateImpl : public ThreadLocalOverloadState {
   void setState(const std::string& action, OverloadActionState state) { actions_[action] = state; }
 
 private:
-  std::unordered_map<std::string, OverloadActionState> actions_;
+  absl::node_hash_map<std::string, OverloadActionState> actions_;
 };
 
 Stats::Counter& makeCounter(Stats::Scope& scope, absl::string_view a, absl::string_view b) {
@@ -84,7 +85,7 @@ OverloadAction::OverloadAction(const envoy::config::overload::v3::OverloadAction
       NOT_REACHED_GCOVR_EXCL_LINE;
     }
 
-    if (!triggers_.insert(std::make_pair(trigger_config.name(), std::move(trigger))).second) {
+    if (!triggers_.try_emplace(trigger_config.name(), std::move(trigger)).second) {
       throw EnvoyException(
           absl::StrCat("Duplicate trigger resource for overload action ", config.name()));
     }
@@ -132,9 +133,7 @@ OverloadManagerImpl::OverloadManagerImpl(Event::Dispatcher& dispatcher, Stats::S
     auto config = Config::Utility::translateToFactoryConfig(resource, validation_visitor, factory);
     auto monitor = factory.createResourceMonitor(*config, context);
 
-    auto result =
-        resources_.emplace(std::piecewise_construct, std::forward_as_tuple(name),
-                           std::forward_as_tuple(name, std::move(monitor), *this, stats_scope));
+    auto result = resources_.try_emplace(name, name, std::move(monitor), *this, stats_scope);
     if (!result.second) {
       throw EnvoyException(absl::StrCat("Duplicate resource monitor ", name));
     }
@@ -143,8 +142,12 @@ OverloadManagerImpl::OverloadManagerImpl(Event::Dispatcher& dispatcher, Stats::S
   for (const auto& action : config.actions()) {
     const auto& name = action.name();
     ENVOY_LOG(debug, "Adding overload action {}", name);
-    auto result = actions_.emplace(std::piecewise_construct, std::forward_as_tuple(name),
-                                   std::forward_as_tuple(action, stats_scope));
+    // TODO: use in place construction once https://github.com/abseil/abseil-cpp/issues/388 is
+    // addressed
+    // We cannot currently use in place construction as the OverloadAction constructor may throw,
+    // causing an inconsistent internal state of the actions_ map, which on destruction results in
+    // an invalid free.
+    auto result = actions_.try_emplace(name, OverloadAction(action, stats_scope));
     if (!result.second) {
       throw EnvoyException(absl::StrCat("Duplicate overload action ", name));
     }
diff --git a/source/server/overload_manager_impl.h b/source/server/overload_manager_impl.h
index d76eedc3659f..4405bfeaf3aa 100644
--- a/source/server/overload_manager_impl.h
+++ b/source/server/overload_manager_impl.h
@@ -1,8 +1,6 @@
 #pragma once
 
 #include <chrono>
-#include <unordered_map>
-#include <unordered_set>
 #include <vector>
 
 #include "envoy/api/api.h"
@@ -17,6 +15,9 @@
 
 #include "common/common/logger.h"
 
+#include "absl/container/node_hash_map.h"
+#include "absl/container/node_hash_set.h"
+
 namespace Envoy {
 namespace Server {
 
@@ -45,8 +46,8 @@ class OverloadAction {
   using TriggerPtr = std::unique_ptr<Trigger>;
 
 private:
-  std::unordered_map<std::string, TriggerPtr> triggers_;
-  std::unordered_set<std::string> fired_triggers_;
+  absl::node_hash_map<std::string, TriggerPtr> triggers_;
+  absl::node_hash_set<std::string> fired_triggers_;
   Stats::Gauge& active_gauge_;
 };
 
@@ -104,8 +105,8 @@ class OverloadManagerImpl : Logger::Loggable<Logger::Id::main>, public OverloadM
   ThreadLocal::SlotPtr tls_;
   const std::chrono::milliseconds refresh_interval_;
   Event::TimerPtr timer_;
-  std::unordered_map<std::string, Resource> resources_;
-  std::unordered_map<std::string, OverloadAction> actions_;
+  absl::node_hash_map<std::string, Resource> resources_;
+  absl::node_hash_map<std::string, OverloadAction> actions_;
 
   using ResourceToActionMap = std::unordered_multimap<std::string, std::string>;
   ResourceToActionMap resource_to_actions_;
diff --git a/source/server/server.cc b/source/server/server.cc
index f192817978e0..912665143c98 100644
--- a/source/server/server.cc
+++ b/source/server/server.cc
@@ -5,7 +5,6 @@
 #include <functional>
 #include <memory>
 #include <string>
-#include <unordered_set>
 
 #include "envoy/admin/v3/config_dump.pb.h"
 #include "envoy/common/exception.h"
diff --git a/test/common/filesystem/directory_test.cc b/test/common/filesystem/directory_test.cc
index b9bfa86a6a47..82f44f977238 100644
--- a/test/common/filesystem/directory_test.cc
+++ b/test/common/filesystem/directory_test.cc
@@ -1,13 +1,13 @@
 #include <fstream>
 #include <stack>
 #include <string>
-#include <unordered_set>
 
 #include "common/filesystem/directory.h"
 
 #include "test/test_common/environment.h"
 #include "test/test_common/utility.h"
 
+#include "absl/container/node_hash_set.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
@@ -66,7 +66,7 @@ struct EntryHash {
   }
 };
 
-using EntrySet = std::unordered_set<DirectoryEntry, EntryHash>;
+using EntrySet = absl::node_hash_set<DirectoryEntry, EntryHash>;
 
 EntrySet getDirectoryContents(const std::string& dir_path, bool recursive) {
   Directory directory(dir_path);
diff --git a/test/common/formatter/substitution_formatter_test.cc b/test/common/formatter/substitution_formatter_test.cc
index 882b9910fa20..66ed458a2344 100644
--- a/test/common/formatter/substitution_formatter_test.cc
+++ b/test/common/formatter/substitution_formatter_test.cc
@@ -1494,7 +1494,7 @@ TEST(SubstitutionFormatterTest, GrpcStatusFormatterTest) {
 }
 
 void verifyJsonOutput(std::string json_string,
-                      std::unordered_map<std::string, std::string> expected_map) {
+                      absl::node_hash_map<std::string, std::string> expected_map) {
   const auto parsed = Json::Factory::loadFromString(json_string);
 
   // Every json log line should have only one newline character, and it should be the last character
@@ -1520,7 +1520,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterPlainStringTest) {
   absl::optional<Http::Protocol> protocol = Http::Protocol::Http11;
   EXPECT_CALL(stream_info, protocol()).WillRepeatedly(Return(protocol));
 
-  std::unordered_map<std::string, std::string> expected_json_map = {
+  absl::node_hash_map<std::string, std::string> expected_json_map = {
       {"plain_string", "plain_string_value"}};
 
   absl::flat_hash_map<std::string, std::string> key_mapping = {
@@ -1544,7 +1544,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterSingleOperatorTest) {
   absl::optional<Http::Protocol> protocol = Http::Protocol::Http11;
   EXPECT_CALL(stream_info, protocol()).WillRepeatedly(Return(protocol));
 
-  std::unordered_map<std::string, std::string> expected_json_map = {{"protocol", "HTTP/1.1"}};
+  absl::node_hash_map<std::string, std::string> expected_json_map = {{"protocol", "HTTP/1.1"}};
 
   absl::flat_hash_map<std::string, std::string> key_mapping = {{"protocol", "%PROTOCOL%"}};
   JsonFormatterImpl formatter(key_mapping, false);
@@ -1561,7 +1561,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterNonExistentHeaderTest) {
   Http::TestResponseTrailerMapImpl response_trailer;
   std::string body;
 
-  std::unordered_map<std::string, std::string> expected_json_map = {
+  absl::node_hash_map<std::string, std::string> expected_json_map = {
       {"protocol", "HTTP/1.1"},
       {"some_request_header", "SOME_REQUEST_HEADER"},
       {"nonexistent_response_header", "-"},
@@ -1591,7 +1591,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterAlternateHeaderTest) {
   Http::TestResponseTrailerMapImpl response_trailer;
   std::string body;
 
-  std::unordered_map<std::string, std::string> expected_json_map = {
+  absl::node_hash_map<std::string, std::string> expected_json_map = {
       {"request_present_header_or_request_absent_header", "REQUEST_PRESENT_HEADER"},
       {"request_absent_header_or_request_present_header", "REQUEST_PRESENT_HEADER"},
       {"response_absent_header_or_response_absent_header", "RESPONSE_PRESENT_HEADER"},
@@ -1628,7 +1628,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterDynamicMetadataTest) {
   EXPECT_CALL(stream_info, dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
   EXPECT_CALL(Const(stream_info), dynamicMetadata()).WillRepeatedly(ReturnRef(metadata));
 
-  std::unordered_map<std::string, std::string> expected_json_map = {
+  absl::node_hash_map<std::string, std::string> expected_json_map = {
       {"test_key", "\"test_value\""},
       {"test_obj", "{\"inner_key\":\"inner_value\"}"},
       {"test_obj.inner_key", "\"inner_value\""}};
@@ -1690,7 +1690,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterFilterStateTest) {
                                      StreamInfo::FilterState::StateType::ReadOnly);
   EXPECT_CALL(Const(stream_info), filterState()).Times(testing::AtLeast(1));
 
-  std::unordered_map<std::string, std::string> expected_json_map = {
+  absl::node_hash_map<std::string, std::string> expected_json_map = {
       {"test_key", "\"test_value\""}, {"test_obj", "{\"inner_key\":\"inner_value\"}"}};
 
   absl::flat_hash_map<std::string, std::string> key_mapping = {
@@ -1746,7 +1746,7 @@ TEST(SubstitutionFormatterTest, FilterStateSpeciferTest) {
       StreamInfo::FilterState::StateType::ReadOnly);
   EXPECT_CALL(Const(stream_info), filterState()).Times(testing::AtLeast(1));
 
-  std::unordered_map<std::string, std::string> expected_json_map = {
+  absl::node_hash_map<std::string, std::string> expected_json_map = {
       {"test_key_plain", "test_value By PLAIN"},
       {"test_key_typed", "\"test_value By TYPED\""},
   };
@@ -1823,7 +1823,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterStartTimeTest) {
   SystemTime time = std::chrono::system_clock::from_time_t(expected_time_in_epoch);
   EXPECT_CALL(stream_info, startTime()).WillRepeatedly(Return(time));
 
-  std::unordered_map<std::string, std::string> expected_json_map = {
+  absl::node_hash_map<std::string, std::string> expected_json_map = {
       {"simple_date", "2018/03/28"},
       {"test_time", fmt::format("{}", expected_time_in_epoch)},
       {"bad_format", "bad_format"},
@@ -1852,7 +1852,7 @@ TEST(SubstitutionFormatterTest, JsonFormatterMultiTokenTest) {
     Http::TestResponseTrailerMapImpl response_trailer;
     std::string body;
 
-    std::unordered_map<std::string, std::string> expected_json_map = {
+    absl::node_hash_map<std::string, std::string> expected_json_map = {
         {"multi_token_field", "HTTP/1.1 plainstring SOME_REQUEST_HEADER SOME_RESPONSE_HEADER"}};
 
     absl::flat_hash_map<std::string, std::string> key_mapping = {
diff --git a/test/common/grpc/google_grpc_utils_test.cc b/test/common/grpc/google_grpc_utils_test.cc
index 2b422af3f4eb..82fa62f6a55c 100644
--- a/test/common/grpc/google_grpc_utils_test.cc
+++ b/test/common/grpc/google_grpc_utils_test.cc
@@ -99,8 +99,8 @@ TEST(GoogleGrpcUtilsTest, ChannelArgsFromConfig) {
   )EOF");
   const grpc::ChannelArguments channel_args = GoogleGrpcUtils::channelArgsFromConfig(config);
   grpc_channel_args effective_args = channel_args.c_channel_args();
-  std::unordered_map<std::string, std::string> string_args;
-  std::unordered_map<std::string, int> int_args;
+  absl::node_hash_map<std::string, std::string> string_args;
+  absl::node_hash_map<std::string, int> int_args;
   for (uint32_t n = 0; n < effective_args.num_args; ++n) {
     const grpc_arg arg = effective_args.args[n];
     ASSERT_TRUE(arg.type == GRPC_ARG_STRING || arg.type == GRPC_ARG_INTEGER);
diff --git a/test/common/http/http2/codec_impl_test_util.h b/test/common/http/http2/codec_impl_test_util.h
index 2ba9f545a20c..339481d6d408 100644
--- a/test/common/http/http2/codec_impl_test_util.h
+++ b/test/common/http/http2/codec_impl_test_util.h
@@ -55,7 +55,7 @@ class TestCodecSettingsProvider {
   }
 
 private:
-  std::unordered_map<int32_t, uint32_t> settings_;
+  absl::node_hash_map<int32_t, uint32_t> settings_;
 };
 
 struct ServerCodecFacade : public virtual Connection {
diff --git a/test/common/network/dns_impl_test.cc b/test/common/network/dns_impl_test.cc
index 3b015ca2a94d..54cf4fbdb8a1 100644
--- a/test/common/network/dns_impl_test.cc
+++ b/test/common/network/dns_impl_test.cc
@@ -1,7 +1,6 @@
 #include <list>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/common/platform.h"
@@ -27,6 +26,7 @@
 #include "test/test_common/utility.h"
 
 #include "absl/container/fixed_array.h"
+#include "absl/container/node_hash_map.h"
 #include "ares.h"
 #include "ares_dns.h"
 #include "gtest/gtest.h"
@@ -53,9 +53,9 @@ namespace {
 // List of IP address (in human readable format).
 using IpList = std::list<std::string>;
 // Map from hostname to IpList.
-using HostMap = std::unordered_map<std::string, IpList>;
+using HostMap = absl::node_hash_map<std::string, IpList>;
 // Map from hostname to CNAME
-using CNameMap = std::unordered_map<std::string, std::string>;
+using CNameMap = absl::node_hash_map<std::string, std::string>;
 // Represents a single TestDnsServer query state and lifecycle. This implements
 // just enough of RFC 1035 to handle queries we generate in the tests below.
 enum class RecordType { A, AAAA };
@@ -320,7 +320,7 @@ class DnsResolverImplPeer {
 
   ares_channel channel() const { return resolver_->channel_; }
   bool isChannelDirty() const { return resolver_->dirty_channel_; }
-  const std::unordered_map<int, Event::FileEventPtr>& events() { return resolver_->events_; }
+  const absl::node_hash_map<int, Event::FileEventPtr>& events() { return resolver_->events_; }
   // Reset the channel state for a DnsResolverImpl such that it will only use
   // TCP and optionally has a zero timeout (for validating timeout behavior).
   void resetChannelTcpOnly(bool zero_timeout) {
diff --git a/test/common/protobuf/utility_test.cc b/test/common/protobuf/utility_test.cc
index 3ae2fb03bcb6..2132fd25e2d2 100644
--- a/test/common/protobuf/utility_test.cc
+++ b/test/common/protobuf/utility_test.cc
@@ -1,5 +1,3 @@
-#include <unordered_set>
-
 #include "envoy/api/v2/cluster.pb.h"
 #include "envoy/api/v2/core/base.pb.h"
 #include "envoy/config/bootstrap/v2/bootstrap.pb.h"
@@ -30,6 +28,7 @@
 #include "test/test_common/logging.h"
 #include "test/test_common/utility.h"
 
+#include "absl/container/node_hash_set.h"
 #include "gtest/gtest.h"
 #include "udpa/type/v1/typed_struct.pb.h"
 
@@ -1142,7 +1141,7 @@ TEST_F(ProtobufUtilityTest, HashedValueStdHash) {
 
   HashedValue hv1(v1), hv2(v2), hv3(v3);
 
-  std::unordered_set<HashedValue> set;
+  absl::node_hash_set<HashedValue> set;
   set.emplace(hv1);
   set.emplace(hv2);
   set.emplace(hv3);
diff --git a/test/common/router/vhds_test.cc b/test/common/router/vhds_test.cc
index 88bd464d7bbb..f1abea4ac04f 100644
--- a/test/common/router/vhds_test.cc
+++ b/test/common/router/vhds_test.cc
@@ -86,7 +86,7 @@ name: my_route
   Init::ExpectableWatcherImpl init_watcher_;
   Init::TargetHandlePtr init_target_handle_;
   const std::string context_ = "vhds_test";
-  std::unordered_set<Envoy::Router::RouteConfigProvider*> providers_;
+  absl::node_hash_set<Envoy::Router::RouteConfigProvider*> providers_;
   Protobuf::util::MessageDifferencer messageDifferencer_;
   std::string default_vhds_config_;
   NiceMock<Envoy::Config::MockSubscriptionFactory> subscription_factory_;
diff --git a/test/common/secret/BUILD b/test/common/secret/BUILD
index b5b05456c3fd..48572641a39b 100644
--- a/test/common/secret/BUILD
+++ b/test/common/secret/BUILD
@@ -14,7 +14,6 @@ envoy_cc_test(
     data = [
         "//test/extensions/transport_sockets/tls/test_data:certs",
     ],
-    tags = ["fails_on_windows"],
     deps = [
         "//source/common/secret:sds_api_lib",
         "//source/common/secret:secret_manager_impl_lib",
diff --git a/test/common/secret/secret_manager_impl_test.cc b/test/common/secret/secret_manager_impl_test.cc
index a947df8417d0..58304e1a1106 100644
--- a/test/common/secret/secret_manager_impl_test.cc
+++ b/test/common/secret/secret_manager_impl_test.cc
@@ -43,7 +43,8 @@ class SecretManagerImplTest : public testing::Test, public Logger::Loggable<Logg
         dynamic_cast<const envoy::admin::v3::SecretsConfigDump&>(*message_ptr);
     envoy::admin::v3::SecretsConfigDump expected_secrets_config_dump;
     TestUtility::loadFromYaml(expected_dump_yaml, expected_secrets_config_dump);
-    EXPECT_EQ(expected_secrets_config_dump.DebugString(), secrets_config_dump.DebugString());
+    EXPECT_THAT(secrets_config_dump,
+                ProtoEqIgnoreRepeatedFieldOrdering(expected_secrets_config_dump));
   }
 
   void setupSecretProviderContext() {}
diff --git a/test/common/stats/thread_local_store_test.cc b/test/common/stats/thread_local_store_test.cc
index daf20f6f2349..726f32174ae8 100644
--- a/test/common/stats/thread_local_store_test.cc
+++ b/test/common/stats/thread_local_store_test.cc
@@ -1,7 +1,6 @@
 #include <chrono>
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/metrics/v3/stats.pb.h"
 #include "envoy/stats/histogram.h"
diff --git a/test/common/upstream/BUILD b/test/common/upstream/BUILD
index cfbabbb44f43..9e76ee81c5df 100644
--- a/test/common/upstream/BUILD
+++ b/test/common/upstream/BUILD
@@ -221,7 +221,6 @@ envoy_cc_test(
 envoy_cc_test(
     name = "load_stats_reporter_test",
     srcs = ["load_stats_reporter_test.cc"],
-    tags = ["fails_on_windows"],
     deps = [
         "//source/common/stats:stats_lib",
         "//source/common/upstream:load_stats_reporter_lib",
diff --git a/test/common/upstream/health_checker_impl_test.cc b/test/common/upstream/health_checker_impl_test.cc
index 46ea30ccd6d5..b20b8b56be23 100644
--- a/test/common/upstream/health_checker_impl_test.cc
+++ b/test/common/upstream/health_checker_impl_test.cc
@@ -136,8 +136,8 @@ class HttpHealthCheckerImplTest : public testing::Test, public HealthCheckerTest
 
   using TestSessionPtr = std::unique_ptr<TestSession>;
   using HostWithHealthCheckMap =
-      std::unordered_map<std::string,
-                         const envoy::config::endpoint::v3::Endpoint::HealthCheckConfig>;
+      absl::node_hash_map<std::string,
+                          const envoy::config::endpoint::v3::Endpoint::HealthCheckConfig>;
 
   void allocHealthChecker(const std::string& yaml, bool avoid_boosting = true) {
     health_checker_ = std::make_shared<TestHttpHealthCheckerImpl>(
diff --git a/test/common/upstream/load_balancer_benchmark.cc b/test/common/upstream/load_balancer_benchmark.cc
index a70f4d920a9a..bb491a788a16 100644
--- a/test/common/upstream/load_balancer_benchmark.cc
+++ b/test/common/upstream/load_balancer_benchmark.cc
@@ -214,7 +214,7 @@ class TestLoadBalancerContext : public LoadBalancerContextBase {
 };
 
 void computeHitStats(benchmark::State& state,
-                     const std::unordered_map<std::string, uint64_t>& hit_counter) {
+                     const absl::node_hash_map<std::string, uint64_t>& hit_counter) {
   double mean = 0;
   for (const auto& pair : hit_counter) {
     mean += pair.second;
@@ -240,7 +240,7 @@ void BM_LeastRequestLoadBalancerChooseHost(benchmark::State& state) {
     const uint64_t choice_count = state.range(1);
     const uint64_t keys_to_simulate = state.range(2);
     LeastRequestTester tester(num_hosts, choice_count);
-    std::unordered_map<std::string, uint64_t> hit_counter;
+    absl::node_hash_map<std::string, uint64_t> hit_counter;
     TestLoadBalancerContext context;
     state.ResumeTiming();
 
@@ -273,12 +273,12 @@ void BM_RingHashLoadBalancerChooseHost(benchmark::State& state) {
     RingHashTester tester(num_hosts, min_ring_size);
     tester.ring_hash_lb_->initialize();
     LoadBalancerPtr lb = tester.ring_hash_lb_->factory()->create();
-    std::unordered_map<std::string, uint64_t> hit_counter;
+    absl::node_hash_map<std::string, uint64_t> hit_counter;
     TestLoadBalancerContext context;
     state.ResumeTiming();
 
     // Note: To a certain extent this is benchmarking the performance of xxhash as well as
-    // std::unordered_map. However, it should be roughly equivalent to the work done when
+    // absl::node_hash_map. However, it should be roughly equivalent to the work done when
     // comparing different hashing algorithms.
     // TODO(mattklein123): When Maglev is a real load balancer, further share code with the
     //                     other test.
@@ -311,12 +311,12 @@ void BM_MaglevLoadBalancerChooseHost(benchmark::State& state) {
     MaglevTester tester(num_hosts);
     tester.maglev_lb_->initialize();
     LoadBalancerPtr lb = tester.maglev_lb_->factory()->create();
-    std::unordered_map<std::string, uint64_t> hit_counter;
+    absl::node_hash_map<std::string, uint64_t> hit_counter;
     TestLoadBalancerContext context;
     state.ResumeTiming();
 
     // Note: To a certain extent this is benchmarking the performance of xxhash as well as
-    // std::unordered_map. However, it should be roughly equivalent to the work done when
+    // absl::node_hash_map. However, it should be roughly equivalent to the work done when
     // comparing different hashing algorithms.
     for (uint64_t i = 0; i < keys_to_simulate; i++) {
       context.hash_key_ = hashInt(i);
diff --git a/test/common/upstream/load_balancer_simulation_test.cc b/test/common/upstream/load_balancer_simulation_test.cc
index 3d8dd616eec2..0f86debac3b8 100644
--- a/test/common/upstream/load_balancer_simulation_test.cc
+++ b/test/common/upstream/load_balancer_simulation_test.cc
@@ -75,13 +75,13 @@ TEST(DISABLED_LeastRequestLoadBalancerWeightTest, Weight) {
   LeastRequestLoadBalancer lb_{
       priority_set, nullptr, stats, runtime, random, common_config, least_request_lb_config};
 
-  std::unordered_map<HostConstSharedPtr, uint64_t> host_hits;
+  absl::node_hash_map<HostConstSharedPtr, uint64_t> host_hits;
   const uint64_t total_requests = 100;
   for (uint64_t i = 0; i < total_requests; i++) {
     host_hits[lb_.chooseHost(nullptr)]++;
   }
 
-  std::unordered_map<uint64_t, double> weight_to_percent;
+  absl::node_hash_map<uint64_t, double> weight_to_percent;
   for (const auto& host : host_hits) {
     std::cout << fmt::format("url:{}, weight:{}, hits:{}, percent_of_total:{}\n",
                              host.first->address()->asString(), host.first->weight(), host.second,
diff --git a/test/common/upstream/load_stats_reporter_test.cc b/test/common/upstream/load_stats_reporter_test.cc
index c22593a84f5c..2fd28c380661 100644
--- a/test/common/upstream/load_stats_reporter_test.cc
+++ b/test/common/upstream/load_stats_reporter_test.cc
@@ -55,7 +55,9 @@ class LoadStatsReporterTest : public testing::Test {
     expected_request.mutable_node()->add_client_features("envoy.lrs.supports_send_all_clusters");
     std::copy(expected_cluster_stats.begin(), expected_cluster_stats.end(),
               Protobuf::RepeatedPtrFieldBackInserter(expected_request.mutable_cluster_stats()));
-    EXPECT_CALL(async_stream_, sendMessageRaw_(Grpc::ProtoBufferEq(expected_request), false));
+    EXPECT_CALL(
+        async_stream_,
+        sendMessageRaw_(Grpc::ProtoBufferEqIgnoreRepeatedFieldOrdering(expected_request), false));
   }
 
   void deliverLoadStatsResponse(const std::vector<std::string>& cluster_names) {
diff --git a/test/common/upstream/ring_hash_lb_test.cc b/test/common/upstream/ring_hash_lb_test.cc
index 9c8a0c7b2652..9c9413233e02 100644
--- a/test/common/upstream/ring_hash_lb_test.cc
+++ b/test/common/upstream/ring_hash_lb_test.cc
@@ -2,7 +2,6 @@
 #include <limits>
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/cluster/v3/cluster.pb.h"
 #include "envoy/router/router.h"
@@ -15,6 +14,7 @@
 #include "test/mocks/runtime/mocks.h"
 #include "test/mocks/upstream/mocks.h"
 
+#include "absl/container/node_hash_map.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
@@ -468,7 +468,7 @@ TEST_P(RingHashLoadBalancerTest, HostWeightedTinyRing) {
   LoadBalancerPtr lb = lb_->factory()->create();
 
   // :90 should appear once, :91 should appear twice and :92 should appear three times.
-  std::unordered_map<uint64_t, uint32_t> expected{
+  absl::node_hash_map<uint64_t, uint32_t> expected{
       {928266305478181108UL, 2},  {4443673547860492590UL, 2},  {5583722120771150861UL, 1},
       {6311230543546372928UL, 1}, {13444792449719432967UL, 2}, {16117243373044804889UL, 0}};
   for (const auto& entry : expected) {
@@ -547,7 +547,7 @@ TEST_P(RingHashLoadBalancerTest, LocalityWeightedTinyRing) {
 
   // :90 should appear once, :91 should appear twice, :92 should appear three times,
   // and :93 shouldn't appear at all.
-  std::unordered_map<uint64_t, uint32_t> expected{
+  absl::node_hash_map<uint64_t, uint32_t> expected{
       {928266305478181108UL, 2},  {4443673547860492590UL, 2},  {5583722120771150861UL, 1},
       {6311230543546372928UL, 1}, {13444792449719432967UL, 2}, {16117243373044804889UL, 0}};
   for (const auto& entry : expected) {
@@ -617,7 +617,7 @@ TEST_P(RingHashLoadBalancerTest, HostAndLocalityWeightedTinyRing) {
 
   // :90 should appear once, :91 and :92 should each appear two times, and :93 should appear four
   // times, to get the correct overall proportions.
-  std::unordered_map<uint64_t, uint32_t> expected{
+  absl::node_hash_map<uint64_t, uint32_t> expected{
       {928266305478181108UL, 2},   {3851675632748031481UL, 3},  {5583722120771150861UL, 1},
       {6311230543546372928UL, 1},  {7700377290971790572UL, 3},  {12559126875973811811UL, 3},
       {13444792449719432967UL, 2}, {13784988426630141778UL, 3}, {16117243373044804889UL, 0}};
@@ -763,7 +763,7 @@ TEST_P(RingHashLoadBalancerTest, LopsidedWeightSmallScale) {
 
   // Every 128th host in the light-but-dense locality should have an entry on the ring, for a total
   // of 8 entries. This gives us the right ratio of 1/128.
-  std::unordered_map<uint64_t, uint32_t> expected{
+  absl::node_hash_map<uint64_t, uint32_t> expected{
       {11664790346325243808UL, 1},   {15894554872961148518UL, 128}, {13958138884277627155UL, 256},
       {15803774069438192949UL, 384}, {3829253010855396576UL, 512},  {17918147347826565154UL, 640},
       {6442769608292299103UL, 768},  {5881074926069334434UL, 896}};
diff --git a/test/common/upstream/upstream_impl_test.cc b/test/common/upstream/upstream_impl_test.cc
index 2adbf136be49..2fd3def01f71 100644
--- a/test/common/upstream/upstream_impl_test.cc
+++ b/test/common/upstream/upstream_impl_test.cc
@@ -814,7 +814,7 @@ TEST_F(StrictDnsClusterImplTest, LoadAssignmentBasic) {
 
   // Remove the duplicated hosts from both resolve targets and ensure that we don't see the same
   // host multiple times.
-  std::unordered_set<HostSharedPtr> removed_hosts;
+  absl::node_hash_set<HostSharedPtr> removed_hosts;
   cluster.prioritySet().addPriorityUpdateCb(
       [&](uint32_t, const HostVector&, const HostVector& hosts_removed) -> void {
         for (const auto& host : hosts_removed) {
diff --git a/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc b/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc
index 9ffaae149de2..602f5836919a 100644
--- a/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc
+++ b/test/extensions/filters/common/ext_authz/ext_authz_http_impl_test.cc
@@ -99,7 +99,7 @@ class ExtAuthzHttpClientTest : public testing::Test {
     return std::make_shared<ClientConfig>(proto_config, timeout, path_prefix);
   }
 
-  Http::RequestMessagePtr sendRequest(std::unordered_map<std::string, std::string>&& headers) {
+  Http::RequestMessagePtr sendRequest(absl::node_hash_map<std::string, std::string>&& headers) {
     envoy::service::auth::v3::CheckRequest request{};
     auto mutable_headers =
         request.mutable_attributes()->mutable_request()->mutable_http()->mutable_headers();
diff --git a/test/extensions/filters/http/jwt_authn/group_verifier_test.cc b/test/extensions/filters/http/jwt_authn/group_verifier_test.cc
index 10ca0909555e..fec4c1430516 100644
--- a/test/extensions/filters/http/jwt_authn/group_verifier_test.cc
+++ b/test/extensions/filters/http/jwt_authn/group_verifier_test.cc
@@ -63,7 +63,7 @@ const char AnyWithAll[] = R"(
             - provider_name: "provider_4"
 )";
 
-using StatusMap = std::unordered_map<std::string, const Status&>;
+using StatusMap = absl::node_hash_map<std::string, const Status>;
 
 constexpr auto allowfailed = "_allow_failed_";
 
@@ -109,9 +109,9 @@ class GroupVerifierTest : public testing::Test {
     return struct_obj;
   }
 
-  std::unordered_map<std::string, AuthenticatorCallback>
+  absl::node_hash_map<std::string, AuthenticatorCallback>
   createAsyncMockAuthsAndVerifier(const std::vector<std::string>& providers) {
-    std::unordered_map<std::string, AuthenticatorCallback> callbacks;
+    absl::node_hash_map<std::string, AuthenticatorCallback> callbacks;
     for (const auto& provider : providers) {
       auto mock_auth = std::make_unique<MockAuthenticator>();
       EXPECT_CALL(*mock_auth, doVerify(_, _, _, _, _))
@@ -130,7 +130,7 @@ class GroupVerifierTest : public testing::Test {
   JwtAuthentication proto_config_;
   VerifierConstPtr verifier_;
   MockVerifierCallbacks mock_cb_;
-  std::unordered_map<std::string, std::unique_ptr<MockAuthenticator>> mock_auths_;
+  absl::node_hash_map<std::string, std::unique_ptr<MockAuthenticator>> mock_auths_;
   NiceMock<MockAuthFactory> mock_factory_;
   ContextSharedPtr context_;
   NiceMock<Tracing::MockSpan> parent_span_;
diff --git a/test/extensions/filters/network/redis_proxy/BUILD b/test/extensions/filters/network/redis_proxy/BUILD
index 24d847f5306f..034d9bd11b7c 100644
--- a/test/extensions/filters/network/redis_proxy/BUILD
+++ b/test/extensions/filters/network/redis_proxy/BUILD
@@ -41,7 +41,6 @@ envoy_extension_cc_test(
     name = "conn_pool_impl_test",
     srcs = ["conn_pool_impl_test.cc"],
     extension_name = "envoy.filters.network.redis_proxy",
-    tags = ["fails_on_windows"],
     deps = [
         ":redis_mocks",
         "//source/common/event:dispatcher_lib",
diff --git a/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc b/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc
index 1d1694cdbfc3..8b56ba1f695f 100644
--- a/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc
+++ b/test/extensions/filters/network/redis_proxy/conn_pool_impl_test.cc
@@ -150,7 +150,7 @@ class RedisConnPoolImplTest : public testing::Test, public Common::Redis::Client
     EXPECT_NE(nullptr, request);
   }
 
-  std::unordered_map<Upstream::HostConstSharedPtr, InstanceImpl::ThreadLocalActiveClientPtr>&
+  absl::node_hash_map<Upstream::HostConstSharedPtr, InstanceImpl::ThreadLocalActiveClientPtr>&
   clientMap() {
     InstanceImpl* conn_pool_impl = dynamic_cast<InstanceImpl*>(conn_pool_.get());
     return conn_pool_impl->tls_->getTyped<InstanceImpl::ThreadLocalPool>().client_map_;
@@ -161,7 +161,7 @@ class RedisConnPoolImplTest : public testing::Test, public Common::Redis::Client
     return conn_pool_impl->tls_->getTyped<InstanceImpl::ThreadLocalPool>().client_map_[host].get();
   }
 
-  std::unordered_map<std::string, Upstream::HostConstSharedPtr>& hostAddressMap() {
+  absl::node_hash_map<std::string, Upstream::HostConstSharedPtr>& hostAddressMap() {
     InstanceImpl* conn_pool_impl = dynamic_cast<InstanceImpl*>(conn_pool_.get());
     return conn_pool_impl->tls_->getTyped<InstanceImpl::ThreadLocalPool>().host_address_map_;
   }
@@ -631,10 +631,6 @@ TEST_F(RedisConnPoolImplTest, RemoteClose) {
 }
 
 TEST_F(RedisConnPoolImplTest, MakeRequestToHost) {
-  InSequence s;
-
-  setup(false);
-
   Common::Redis::RespValue value;
   Common::Redis::Client::MockPoolRequest active_request1;
   Common::Redis::Client::MockPoolRequest active_request2;
@@ -645,48 +641,55 @@ TEST_F(RedisConnPoolImplTest, MakeRequestToHost) {
   Upstream::HostConstSharedPtr host1;
   Upstream::HostConstSharedPtr host2;
 
-  // There is no cluster yet, so makeRequestToHost() should fail.
-  EXPECT_EQ(nullptr, conn_pool_->makeRequestToHost("10.0.0.1:3000", value, callbacks1));
-  // Add the cluster now.
-  update_callbacks_->onClusterAddOrUpdate(cm_.thread_local_cluster_);
-
-  EXPECT_CALL(*this, create_(_)).WillOnce(DoAll(SaveArg<0>(&host1), Return(client1)));
-  EXPECT_CALL(*client1, makeRequest_(Ref(value), Ref(callbacks1)))
-      .WillOnce(Return(&active_request1));
-  Common::Redis::Client::PoolRequest* request1 =
-      conn_pool_->makeRequestToHost("10.0.0.1:3000", value, callbacks1);
-  EXPECT_EQ(&active_request1, request1);
-  EXPECT_EQ(host1->address()->asString(), "10.0.0.1:3000");
-
-  // IPv6 address returned from Redis server will not have square brackets
-  // around it, while Envoy represents Address::Ipv6Instance addresses with square brackets around
-  // the address.
-  EXPECT_CALL(*this, create_(_)).WillOnce(DoAll(SaveArg<0>(&host2), Return(client2)));
-  EXPECT_CALL(*client2, makeRequest_(Ref(value), Ref(callbacks2)))
-      .WillOnce(Return(&active_request2));
-  Common::Redis::Client::PoolRequest* request2 =
-      conn_pool_->makeRequestToHost("2001:470:813B:0:0:0:0:1:3333", value, callbacks2);
-  EXPECT_EQ(&active_request2, request2);
-  EXPECT_EQ(host2->address()->asString(), "[2001:470:813b::1]:3333");
+  {
+    InSequence s;
 
-  // Test with a badly specified host address (no colon, no address, no port).
-  EXPECT_EQ(conn_pool_->makeRequestToHost("bad", value, callbacks1), nullptr);
-  // Test with a badly specified IPv4 address.
-  EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.bad:3000", value, callbacks1), nullptr);
-  // Test with a badly specified TCP port.
-  EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.0.1:bad", value, callbacks1), nullptr);
-  // Test with a TCP port outside of the acceptable range for a 32-bit integer.
-  EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.0.1:4294967297", value, callbacks1),
-            nullptr); // 2^32 + 1
-  // Test with a TCP port outside of the acceptable range for a TCP port (0 .. 65535).
-  EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.0.1:65536", value, callbacks1), nullptr);
-  // Test with a badly specified IPv6-like address.
-  EXPECT_EQ(conn_pool_->makeRequestToHost("bad:ipv6:3000", value, callbacks1), nullptr);
-  // Test with a valid IPv6 address and a badly specified TCP port (out of range).
-  EXPECT_EQ(conn_pool_->makeRequestToHost("2001:470:813b:::70000", value, callbacks1), nullptr);
+    setup(false);
+
+    // There is no cluster yet, so makeRequestToHost() should fail.
+    EXPECT_EQ(nullptr, conn_pool_->makeRequestToHost("10.0.0.1:3000", value, callbacks1));
+    // Add the cluster now.
+    update_callbacks_->onClusterAddOrUpdate(cm_.thread_local_cluster_);
+
+    EXPECT_CALL(*this, create_(_)).WillOnce(DoAll(SaveArg<0>(&host1), Return(client1)));
+    EXPECT_CALL(*client1, makeRequest_(Ref(value), Ref(callbacks1)))
+        .WillOnce(Return(&active_request1));
+    Common::Redis::Client::PoolRequest* request1 =
+        conn_pool_->makeRequestToHost("10.0.0.1:3000", value, callbacks1);
+    EXPECT_EQ(&active_request1, request1);
+    EXPECT_EQ(host1->address()->asString(), "10.0.0.1:3000");
+
+    // IPv6 address returned from Redis server will not have square brackets
+    // around it, while Envoy represents Address::Ipv6Instance addresses with square brackets around
+    // the address.
+    EXPECT_CALL(*this, create_(_)).WillOnce(DoAll(SaveArg<0>(&host2), Return(client2)));
+    EXPECT_CALL(*client2, makeRequest_(Ref(value), Ref(callbacks2)))
+        .WillOnce(Return(&active_request2));
+    Common::Redis::Client::PoolRequest* request2 =
+        conn_pool_->makeRequestToHost("2001:470:813B:0:0:0:0:1:3333", value, callbacks2);
+    EXPECT_EQ(&active_request2, request2);
+    EXPECT_EQ(host2->address()->asString(), "[2001:470:813b::1]:3333");
+
+    // Test with a badly specified host address (no colon, no address, no port).
+    EXPECT_EQ(conn_pool_->makeRequestToHost("bad", value, callbacks1), nullptr);
+    // Test with a badly specified IPv4 address.
+    EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.bad:3000", value, callbacks1), nullptr);
+    // Test with a badly specified TCP port.
+    EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.0.1:bad", value, callbacks1), nullptr);
+    // Test with a TCP port outside of the acceptable range for a 32-bit integer.
+    EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.0.1:4294967297", value, callbacks1),
+              nullptr); // 2^32 + 1
+    // Test with a TCP port outside of the acceptable range for a TCP port (0 .. 65535).
+    EXPECT_EQ(conn_pool_->makeRequestToHost("10.0.0.1:65536", value, callbacks1), nullptr);
+    // Test with a badly specified IPv6-like address.
+    EXPECT_EQ(conn_pool_->makeRequestToHost("bad:ipv6:3000", value, callbacks1), nullptr);
+    // Test with a valid IPv6 address and a badly specified TCP port (out of range).
+    EXPECT_EQ(conn_pool_->makeRequestToHost("2001:470:813b:::70000", value, callbacks1), nullptr);
+  }
 
-  EXPECT_CALL(*client2, close());
+  // We cannot guarantee which order close will be called, perform these checks unsequenced
   EXPECT_CALL(*client1, close());
+  EXPECT_CALL(*client2, close());
   tls_.shutdownThread();
 }
 
@@ -741,7 +744,7 @@ TEST_F(RedisConnPoolImplTest, HostsAddedAndRemovedWithDraining) {
   EXPECT_EQ(&active_request2, request2);
   EXPECT_EQ(host2->address()->asString(), "[2001:470:813b::1]:3333");
 
-  std::unordered_map<std::string, Upstream::HostConstSharedPtr>& host_address_map =
+  absl::node_hash_map<std::string, Upstream::HostConstSharedPtr>& host_address_map =
       hostAddressMap();
   EXPECT_EQ(host_address_map.size(), 2); // host1 and host2 have been created.
   EXPECT_EQ(host_address_map[host1->address()->asString()], host1);
@@ -840,7 +843,7 @@ TEST_F(RedisConnPoolImplTest, HostsAddedAndEndWithNoDraining) {
   EXPECT_EQ(&active_request2, request2);
   EXPECT_EQ(host2->address()->asString(), "[2001:470:813b::1]:3333");
 
-  std::unordered_map<std::string, Upstream::HostConstSharedPtr>& host_address_map =
+  absl::node_hash_map<std::string, Upstream::HostConstSharedPtr>& host_address_map =
       hostAddressMap();
   EXPECT_EQ(host_address_map.size(), 2); // host1 and host2 have been created.
   EXPECT_EQ(host_address_map[host1->address()->asString()], host1);
@@ -918,7 +921,7 @@ TEST_F(RedisConnPoolImplTest, HostsAddedAndEndWithClusterRemoval) {
   EXPECT_EQ(&active_request2, request2);
   EXPECT_EQ(host2->address()->asString(), "[2001:470:813b::1]:3333");
 
-  std::unordered_map<std::string, Upstream::HostConstSharedPtr>& host_address_map =
+  absl::node_hash_map<std::string, Upstream::HostConstSharedPtr>& host_address_map =
       hostAddressMap();
   EXPECT_EQ(host_address_map.size(), 2); // host1 and host2 have been created.
   EXPECT_EQ(host_address_map[host1->address()->asString()], host1);
diff --git a/test/extensions/filters/network/rocketmq_proxy/active_message_test.cc b/test/extensions/filters/network/rocketmq_proxy/active_message_test.cc
index 4715637df2b5..54f01cfaeea0 100644
--- a/test/extensions/filters/network/rocketmq_proxy/active_message_test.cc
+++ b/test/extensions/filters/network/rocketmq_proxy/active_message_test.cc
@@ -75,7 +75,7 @@ TEST_F(ActiveMessageTest, ClusterName) {
 
 TEST_F(ActiveMessageTest, FillBrokerData) {
 
-  std::unordered_map<int64_t, std::string> address;
+  absl::node_hash_map<int64_t, std::string> address;
   address.emplace(0, "1.2.3.4:10911");
   BrokerData broker_data("DefaultCluster", "broker-a", std::move(address));
 
diff --git a/test/extensions/filters/network/rocketmq_proxy/topic_route_test.cc b/test/extensions/filters/network/rocketmq_proxy/topic_route_test.cc
index a2392b0c0603..a337b89ead69 100644
--- a/test/extensions/filters/network/rocketmq_proxy/topic_route_test.cc
+++ b/test/extensions/filters/network/rocketmq_proxy/topic_route_test.cc
@@ -1,9 +1,8 @@
-#include <unordered_map>
-
 #include "common/protobuf/utility.h"
 
 #include "extensions/filters/network/rocketmq_proxy/topic_route.h"
 
+#include "absl/container/node_hash_map.h"
 #include "gtest/gtest.h"
 
 namespace Envoy {
@@ -26,7 +25,7 @@ TEST(TopicRouteTest, Serialization) {
 }
 
 TEST(BrokerDataTest, Serialization) {
-  std::unordered_map<int64_t, std::string> broker_addrs;
+  absl::node_hash_map<int64_t, std::string> broker_addrs;
   std::string dummy_address("127.0.0.1:10911");
   for (int64_t i = 0; i < 3; i++) {
     broker_addrs[i] = dummy_address;
@@ -56,7 +55,7 @@ TEST(TopicRouteDataTest, Serialization) {
   std::string dummy_address("127.0.0.1:10911");
 
   for (int i = 0; i < 16; i++) {
-    std::unordered_map<int64_t, std::string> broker_addrs;
+    absl::node_hash_map<int64_t, std::string> broker_addrs;
     for (int64_t i = 0; i < 3; i++) {
       broker_addrs[i] = dummy_address;
     }
diff --git a/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc b/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc
index d8408586a96e..50e24f4e0f0d 100644
--- a/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc
+++ b/test/extensions/quic_listeners/quiche/platform/quic_platform_test.cc
@@ -7,7 +7,6 @@
 #include <netinet/in.h>
 
 #include <fstream>
-#include <unordered_set>
 
 #include "common/memory/stats.h"
 #include "common/network/socket_impl.h"
diff --git a/test/extensions/stats_sinks/hystrix/hystrix_test.cc b/test/extensions/stats_sinks/hystrix/hystrix_test.cc
index 5c76dd9499d8..463d437c3d46 100644
--- a/test/extensions/stats_sinks/hystrix/hystrix_test.cc
+++ b/test/extensions/stats_sinks/hystrix/hystrix_test.cc
@@ -157,7 +157,7 @@ class HystrixSinkTest : public testing::Test {
     addClusterToMap(cluster2_name_, cluster2_.cluster_);
   }
 
-  std::unordered_map<std::string, std::string>
+  absl::node_hash_map<std::string, std::string>
   addSecondClusterAndSendDataHelper(Buffer::OwnedImpl& buffer, const uint64_t success_step,
                                     const uint64_t error_step, const uint64_t timeout_step,
                                     const uint64_t success_step2, const uint64_t error_step2,
@@ -216,8 +216,8 @@ class HystrixSinkTest : public testing::Test {
     }
   }
 
-  std::unordered_map<std::string, std::string> buildClusterMap(absl::string_view data_message) {
-    std::unordered_map<std::string, std::string> cluster_message_map;
+  absl::node_hash_map<std::string, std::string> buildClusterMap(absl::string_view data_message) {
+    absl::node_hash_map<std::string, std::string> cluster_message_map;
     std::vector<std::string> messages =
         absl::StrSplit(data_message, "data: ", absl::SkipWhitespace());
     for (auto message : messages) {
@@ -257,7 +257,7 @@ TEST_F(HystrixSinkTest, EmptyFlush) {
   // Register callback to sink.
   sink_->registerConnection(&callbacks_);
   sink_->flush(snapshot_);
-  std::unordered_map<std::string, std::string> cluster_message_map =
+  absl::node_hash_map<std::string, std::string> cluster_message_map =
       buildClusterMap(buffer.toString());
   validateResults(cluster_message_map[cluster1_name_], 0, 0, 0, 0, 0, window_size_);
 }
@@ -280,7 +280,7 @@ TEST_F(HystrixSinkTest, BasicFlow) {
     sink_->flush(snapshot_);
   }
 
-  std::unordered_map<std::string, std::string> cluster_message_map =
+  absl::node_hash_map<std::string, std::string> cluster_message_map =
       buildClusterMap(buffer.toString());
 
   Json::ObjectSharedPtr json_buffer =
@@ -352,7 +352,7 @@ TEST_F(HystrixSinkTest, Disconnect) {
   }
 
   EXPECT_NE(buffer.length(), 0);
-  std::unordered_map<std::string, std::string> cluster_message_map =
+  absl::node_hash_map<std::string, std::string> cluster_message_map =
       buildClusterMap(buffer.toString());
   Json::ObjectSharedPtr json_buffer =
       Json::Factory::loadFromString(cluster_message_map[cluster1_name_]);
@@ -392,7 +392,7 @@ TEST_F(HystrixSinkTest, AddCluster) {
   Buffer::OwnedImpl buffer = createClusterAndCallbacks();
 
   // Add cluster and "run" some traffic.
-  std::unordered_map<std::string, std::string> cluster_message_map =
+  absl::node_hash_map<std::string, std::string> cluster_message_map =
       addSecondClusterAndSendDataHelper(buffer, success_step, error_step, timeout_step,
                                         success_step2, error_step2, timeout_step2);
 
@@ -433,7 +433,7 @@ TEST_F(HystrixSinkTest, AddAndRemoveClusters) {
   removeSecondClusterHelper(buffer);
 
   // Check that removed worked.
-  std::unordered_map<std::string, std::string> cluster_message_map =
+  absl::node_hash_map<std::string, std::string> cluster_message_map =
       buildClusterMap(buffer.toString());
   ASSERT_NE(cluster_message_map.find(cluster1_name_), cluster_message_map.end())
       << "cluster1_name = " << cluster1_name_;
@@ -485,7 +485,7 @@ TEST_F(HystrixSinkTest, HistogramTest) {
   sink_->registerConnection(&callbacks_);
   sink_->flush(snapshot_);
 
-  std::unordered_map<std::string, std::string> cluster_message_map =
+  absl::node_hash_map<std::string, std::string> cluster_message_map =
       buildClusterMap(buffer.toString());
 
   Json::ObjectSharedPtr latency = Json::Factory::loadFromString(cluster_message_map[cluster1_name_])
diff --git a/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc b/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc
index 12041fdd5860..bd51f1493e5c 100644
--- a/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc
+++ b/test/extensions/tracers/zipkin/zipkin_tracer_impl_test.cc
@@ -2,7 +2,6 @@
 #include <functional>
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/trace/v3/zipkin.pb.h"
 
diff --git a/test/fuzz/utility.h b/test/fuzz/utility.h
index 171674a7ff04..534e5f1f8850 100644
--- a/test/fuzz/utility.h
+++ b/test/fuzz/utility.h
@@ -83,8 +83,8 @@ replaceInvalidStringValues(const envoy::config::core::v3::Metadata& upstream_met
 template <class T>
 inline T fromHeaders(
     const test::fuzz::Headers& headers,
-    const std::unordered_set<std::string>& ignore_headers = std::unordered_set<std::string>(),
-    std::unordered_set<std::string> include_headers = std::unordered_set<std::string>()) {
+    const absl::node_hash_set<std::string>& ignore_headers = absl::node_hash_set<std::string>(),
+    absl::node_hash_set<std::string> include_headers = absl::node_hash_set<std::string>()) {
   T header_map;
   for (const auto& header : headers.headers()) {
     if (ignore_headers.find(absl::AsciiStrToLower(header.key())) == ignore_headers.end()) {
diff --git a/test/integration/fake_upstream.h b/test/integration/fake_upstream.h
index 6afeb17b36a9..ef2a79c92cdb 100644
--- a/test/integration/fake_upstream.h
+++ b/test/integration/fake_upstream.h
@@ -200,8 +200,8 @@ class FakeStream : public Http::RequestDecoder,
 
   Event::TestTimeSystem& timeSystem() { return time_system_; }
 
-  Http::MetadataMap& metadata_map() { return metadata_map_; }
-  std::unordered_map<std::string, uint64_t>& duplicated_metadata_key_count() {
+  Http::MetadataMap& metadataMap() { return metadata_map_; }
+  absl::node_hash_map<std::string, uint64_t>& duplicatedMetadataKeyCount() {
     return duplicated_metadata_key_count_;
   }
 
@@ -222,7 +222,7 @@ class FakeStream : public Http::RequestDecoder,
   bool add_served_by_header_{};
   Event::TestTimeSystem& time_system_;
   Http::MetadataMap metadata_map_;
-  std::unordered_map<std::string, uint64_t> duplicated_metadata_key_count_;
+  absl::node_hash_map<std::string, uint64_t> duplicated_metadata_key_count_;
   bool received_data_{false};
 };
 
diff --git a/test/integration/http2_integration_test.cc b/test/integration/http2_integration_test.cc
index aea7937dc7db..a2a35d244103 100644
--- a/test/integration/http2_integration_test.cc
+++ b/test/integration/http2_integration_test.cc
@@ -152,7 +152,7 @@ TEST_P(Http2MetadataIntegrationTest, ProxyMetadataInResponse) {
   // Verifies metadata is received by the client.
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  EXPECT_EQ(response->metadata_map().find(key)->second, value);
+  EXPECT_EQ(response->metadataMap().find(key)->second, value);
 
   // Sends the second request.
   response = codec_client_->makeRequestWithBody(default_request_headers_, 10);
@@ -171,7 +171,7 @@ TEST_P(Http2MetadataIntegrationTest, ProxyMetadataInResponse) {
   // Verifies metadata is received by the client.
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  EXPECT_EQ(response->metadata_map().find(key)->second, value);
+  EXPECT_EQ(response->metadataMap().find(key)->second, value);
 
   // Sends the third request.
   response = codec_client_->makeRequestWithBody(default_request_headers_, 10);
@@ -190,7 +190,7 @@ TEST_P(Http2MetadataIntegrationTest, ProxyMetadataInResponse) {
   // Verifies metadata is received by the client.
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  EXPECT_EQ(response->metadata_map().find(key)->second, value);
+  EXPECT_EQ(response->metadataMap().find(key)->second, value);
 
   // Sends the fourth request.
   response = codec_client_->makeRequestWithBody(default_request_headers_, 10);
@@ -210,7 +210,7 @@ TEST_P(Http2MetadataIntegrationTest, ProxyMetadataInResponse) {
   // Verifies metadata is received by the client.
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  EXPECT_EQ(response->metadata_map().find(key)->second, value);
+  EXPECT_EQ(response->metadataMap().find(key)->second, value);
 
   // Sends the fifth request.
   response = codec_client_->makeRequestWithBody(default_request_headers_, 10);
@@ -230,7 +230,7 @@ TEST_P(Http2MetadataIntegrationTest, ProxyMetadataInResponse) {
   // Verifies metadata is received by the client.
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  EXPECT_EQ(response->metadata_map().find(key)->second, value);
+  EXPECT_EQ(response->metadataMap().find(key)->second, value);
 
   // Sends the sixth request.
   response = codec_client_->makeRequestWithBody(default_request_headers_, 10);
@@ -283,10 +283,10 @@ TEST_P(Http2MetadataIntegrationTest, ProxyMultipleMetadata) {
   ASSERT_TRUE(response->complete());
   for (int i = 0; i < size; i++) {
     for (const auto& metadata : *multiple_vecs[i][0]) {
-      EXPECT_EQ(response->metadata_map().find(metadata.first)->second, metadata.second);
+      EXPECT_EQ(response->metadataMap().find(metadata.first)->second, metadata.second);
     }
   }
-  EXPECT_EQ(response->metadata_map().size(), multiple_vecs.size());
+  EXPECT_EQ(response->metadataMap().size(), multiple_vecs.size());
 }
 
 TEST_P(Http2MetadataIntegrationTest, ProxyInvalidMetadata) {
@@ -314,7 +314,7 @@ TEST_P(Http2MetadataIntegrationTest, ProxyInvalidMetadata) {
   // Verifies metadata is not received by the client.
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  EXPECT_EQ(response->metadata_map().size(), 0);
+  EXPECT_EQ(response->metadataMap().size(), 0);
 }
 
 void verifyExpectedMetadata(Http::MetadataMap metadata_map, std::set<std::string> keys) {
@@ -342,7 +342,7 @@ TEST_P(Http2MetadataIntegrationTest, TestResponseMetadata) {
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
   std::set<std::string> expected_metadata_keys = {"headers", "duplicate"};
-  verifyExpectedMetadata(response->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(response->metadataMap(), expected_metadata_keys);
 
   // Upstream responds with headers and data.
   response = codec_client_->makeRequestWithBody(default_request_headers_, 10);
@@ -353,7 +353,7 @@ TEST_P(Http2MetadataIntegrationTest, TestResponseMetadata) {
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
   expected_metadata_keys.insert("data");
-  verifyExpectedMetadata(response->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(response->metadataMap(), expected_metadata_keys);
   EXPECT_EQ(response->keyCount("duplicate"), 2);
 
   // Upstream responds with headers, data and trailers.
@@ -367,7 +367,7 @@ TEST_P(Http2MetadataIntegrationTest, TestResponseMetadata) {
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
   expected_metadata_keys.insert("trailers");
-  verifyExpectedMetadata(response->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(response->metadataMap(), expected_metadata_keys);
   EXPECT_EQ(response->keyCount("duplicate"), 3);
 
   // Upstream responds with headers, 100-continue and data.
@@ -389,7 +389,7 @@ TEST_P(Http2MetadataIntegrationTest, TestResponseMetadata) {
   ASSERT_TRUE(response->complete());
   expected_metadata_keys.erase("trailers");
   expected_metadata_keys.insert("100-continue");
-  verifyExpectedMetadata(response->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(response->metadataMap(), expected_metadata_keys);
   EXPECT_EQ(response->keyCount("duplicate"), 4);
 
   // Upstream responds with headers and metadata that will not be consumed.
@@ -408,7 +408,7 @@ TEST_P(Http2MetadataIntegrationTest, TestResponseMetadata) {
   expected_metadata_keys.erase("100-continue");
   expected_metadata_keys.insert("aaa");
   expected_metadata_keys.insert("keep");
-  verifyExpectedMetadata(response->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(response->metadataMap(), expected_metadata_keys);
 
   // Upstream responds with headers, data and metadata that will be consumed.
   response = codec_client_->makeRequestWithBody(default_request_headers_, 10);
@@ -426,7 +426,7 @@ TEST_P(Http2MetadataIntegrationTest, TestResponseMetadata) {
   expected_metadata_keys.erase("aaa");
   expected_metadata_keys.insert("data");
   expected_metadata_keys.insert("replace");
-  verifyExpectedMetadata(response->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(response->metadataMap(), expected_metadata_keys);
   EXPECT_EQ(response->keyCount("duplicate"), 2);
 }
 
@@ -476,9 +476,9 @@ TEST_P(Http2MetadataIntegrationTest, ProxySmallMetadataInRequest) {
 
   // Verifies metadata is received by upstream.
   upstream_request_->encodeHeaders(default_response_headers_, true);
-  EXPECT_EQ(upstream_request_->metadata_map().find("key")->second, "value");
-  EXPECT_EQ(upstream_request_->metadata_map().size(), 1);
-  EXPECT_EQ(upstream_request_->duplicated_metadata_key_count().find("key")->second, 3);
+  EXPECT_EQ(upstream_request_->metadataMap().find("key")->second, "value");
+  EXPECT_EQ(upstream_request_->metadataMap().size(), 1);
+  EXPECT_EQ(upstream_request_->duplicatedMetadataKeyCount().find("key")->second, 3);
 
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
@@ -506,9 +506,9 @@ TEST_P(Http2MetadataIntegrationTest, ProxyLargeMetadataInRequest) {
 
   // Verifies metadata is received upstream.
   upstream_request_->encodeHeaders(default_response_headers_, true);
-  EXPECT_EQ(upstream_request_->metadata_map().find("key")->second, value);
-  EXPECT_EQ(upstream_request_->metadata_map().size(), 1);
-  EXPECT_EQ(upstream_request_->duplicated_metadata_key_count().find("key")->second, 3);
+  EXPECT_EQ(upstream_request_->metadataMap().find("key")->second, value);
+  EXPECT_EQ(upstream_request_->metadataMap().size(), 1);
+  EXPECT_EQ(upstream_request_->duplicatedMetadataKeyCount().find("key")->second, 3);
 
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
@@ -565,7 +565,7 @@ TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
   // Verifies a headers metadata added.
   std::set<std::string> expected_metadata_keys = {"headers"};
   expected_metadata_keys.insert("metadata");
-  verifyExpectedMetadata(upstream_request_->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(upstream_request_->metadataMap(), expected_metadata_keys);
 
   // Sends a headers only request with metadata. An empty data frame carries end_stream.
   auto encoder_decoder = codec_client_->startRequest(default_request_headers_);
@@ -582,8 +582,8 @@ TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
   expected_metadata_keys.insert("data");
   expected_metadata_keys.insert("metadata");
   expected_metadata_keys.insert("replace");
-  verifyExpectedMetadata(upstream_request_->metadata_map(), expected_metadata_keys);
-  EXPECT_EQ(upstream_request_->duplicated_metadata_key_count().find("metadata")->second, 3);
+  verifyExpectedMetadata(upstream_request_->metadataMap(), expected_metadata_keys);
+  EXPECT_EQ(upstream_request_->duplicatedMetadataKeyCount().find("metadata")->second, 3);
   // Verifies zero length data received, and end_stream is true.
   EXPECT_EQ(true, upstream_request_->receivedData());
   EXPECT_EQ(0, upstream_request_->bodyLength());
@@ -604,8 +604,8 @@ TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
   expected_metadata_keys.insert("trailers");
-  verifyExpectedMetadata(upstream_request_->metadata_map(), expected_metadata_keys);
-  EXPECT_EQ(upstream_request_->duplicated_metadata_key_count().find("metadata")->second, 4);
+  verifyExpectedMetadata(upstream_request_->metadataMap(), expected_metadata_keys);
+  EXPECT_EQ(upstream_request_->duplicatedMetadataKeyCount().find("metadata")->second, 4);
 
   // Sends headers, large data, metadata. Large data triggers decodeData() multiple times, and each
   // time, a "data" metadata is added.
@@ -622,9 +622,9 @@ TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
   ASSERT_TRUE(response->complete());
 
   expected_metadata_keys.erase("trailers");
-  verifyExpectedMetadata(upstream_request_->metadata_map(), expected_metadata_keys);
-  EXPECT_GE(upstream_request_->duplicated_metadata_key_count().find("data")->second, 2);
-  EXPECT_GE(upstream_request_->duplicated_metadata_key_count().find("metadata")->second, 3);
+  verifyExpectedMetadata(upstream_request_->metadataMap(), expected_metadata_keys);
+  EXPECT_GE(upstream_request_->duplicatedMetadataKeyCount().find("data")->second, 2);
+  EXPECT_GE(upstream_request_->duplicatedMetadataKeyCount().find("metadata")->second, 3);
 
   // Sends multiple metadata.
   auto encoder_decoder_4 = codec_client_->startRequest(default_request_headers_);
@@ -646,8 +646,8 @@ TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
   expected_metadata_keys.insert("metadata1");
   expected_metadata_keys.insert("metadata2");
   expected_metadata_keys.insert("trailers");
-  verifyExpectedMetadata(upstream_request_->metadata_map(), expected_metadata_keys);
-  EXPECT_EQ(upstream_request_->duplicated_metadata_key_count().find("metadata")->second, 6);
+  verifyExpectedMetadata(upstream_request_->metadataMap(), expected_metadata_keys);
+  EXPECT_EQ(upstream_request_->duplicatedMetadataKeyCount().find("metadata")->second, 6);
 }
 
 static std::string decode_headers_only = R"EOF(
@@ -691,7 +691,7 @@ void Http2MetadataIntegrationTest::verifyHeadersOnlyTest() {
   // Verifies a headers metadata added.
   std::set<std::string> expected_metadata_keys = {"headers"};
   expected_metadata_keys.insert("metadata");
-  verifyExpectedMetadata(upstream_request_->metadata_map(), expected_metadata_keys);
+  verifyExpectedMetadata(upstream_request_->metadataMap(), expected_metadata_keys);
 
   // Verifies zero length data received, and end_stream is true.
   EXPECT_EQ(true, upstream_request_->receivedData());
@@ -754,8 +754,8 @@ void Http2MetadataIntegrationTest::testRequestMetadataWithStopAllFilter() {
   ASSERT_TRUE(response->complete());
   std::set<std::string> expected_metadata_keys = {"headers",   "data",    "metadata", "metadata1",
                                                   "metadata2", "replace", "trailers"};
-  verifyExpectedMetadata(upstream_request_->metadata_map(), expected_metadata_keys);
-  EXPECT_EQ(upstream_request_->duplicated_metadata_key_count().find("metadata")->second, 6);
+  verifyExpectedMetadata(upstream_request_->metadataMap(), expected_metadata_keys);
+  EXPECT_EQ(upstream_request_->duplicatedMetadataKeyCount().find("metadata")->second, 6);
 }
 
 static std::string metadata_stop_all_filter = R"EOF(
@@ -805,10 +805,10 @@ name: encode-headers-return-stop-all-filter
 
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  EXPECT_EQ(response->metadata_map().find("headers")->second, "headers");
-  EXPECT_EQ(response->metadata_map().find("data")->second, "data");
-  EXPECT_EQ(response->metadata_map().find("trailers")->second, "trailers");
-  EXPECT_EQ(response->metadata_map().size(), 3);
+  EXPECT_EQ(response->metadataMap().find("headers")->second, "headers");
+  EXPECT_EQ(response->metadataMap().find("data")->second, "data");
+  EXPECT_EQ(response->metadataMap().find("trailers")->second, "trailers");
+  EXPECT_EQ(response->metadataMap().size(), 3);
   EXPECT_EQ(count * size + added_decoded_data_size * 2, response->body().size());
 }
 
diff --git a/test/integration/http_integration.cc b/test/integration/http_integration.cc
index 554aadb78602..56d738e3b9ce 100644
--- a/test/integration/http_integration.cc
+++ b/test/integration/http_integration.cc
@@ -842,9 +842,9 @@ void HttpIntegrationTest::testEnvoyHandling100Continue(bool additional_continue_
 
   response->waitForEndStream();
   ASSERT_TRUE(response->complete());
-  ASSERT(response->continue_headers() != nullptr);
-  EXPECT_EQ("100", response->continue_headers()->getStatusValue());
-  EXPECT_EQ(nullptr, response->continue_headers()->Via());
+  ASSERT(response->continueHeaders() != nullptr);
+  EXPECT_EQ("100", response->continueHeaders()->getStatusValue());
+  EXPECT_EQ(nullptr, response->continueHeaders()->Via());
   EXPECT_EQ("200", response->headers().getStatusValue());
   if (via.empty()) {
     EXPECT_EQ(nullptr, response->headers().Via());
@@ -926,8 +926,8 @@ void HttpIntegrationTest::testEnvoyProxying1xx(bool continue_before_upstream_com
   upstream_request_->encodeHeaders(default_response_headers_, true);
   response->waitForEndStream();
   EXPECT_TRUE(response->complete());
-  ASSERT(response->continue_headers() != nullptr);
-  EXPECT_EQ("100", response->continue_headers()->getStatusValue());
+  ASSERT(response->continueHeaders() != nullptr);
+  EXPECT_EQ("100", response->continueHeaders()->getStatusValue());
 
   EXPECT_EQ("200", response->headers().getStatusValue());
 }
diff --git a/test/integration/integration.h b/test/integration/integration.h
index 6f3825c054d8..dfee7b131ff0 100644
--- a/test/integration/integration.h
+++ b/test/integration/integration.h
@@ -42,11 +42,11 @@ class IntegrationStreamDecoder : public Http::ResponseDecoder, public Http::Stre
   const std::string& body() { return body_; }
   bool complete() { return saw_end_stream_; }
   bool reset() { return saw_reset_; }
-  Http::StreamResetReason reset_reason() { return reset_reason_; }
-  const Http::ResponseHeaderMap* continue_headers() { return continue_headers_.get(); }
+  Http::StreamResetReason resetReason() { return reset_reason_; }
+  const Http::ResponseHeaderMap* continueHeaders() { return continue_headers_.get(); }
   const Http::ResponseHeaderMap& headers() { return *headers_; }
   const Http::ResponseTrailerMapPtr& trailers() { return trailers_; }
-  const Http::MetadataMap& metadata_map() { return *metadata_map_; }
+  const Http::MetadataMap& metadataMap() { return *metadata_map_; }
   uint64_t keyCount(std::string key) { return duplicated_metadata_key_count_[key]; }
   void waitForContinueHeaders();
   void waitForHeaders();
@@ -79,7 +79,7 @@ class IntegrationStreamDecoder : public Http::ResponseDecoder, public Http::Stre
   Http::ResponseHeaderMapPtr headers_;
   Http::ResponseTrailerMapPtr trailers_;
   Http::MetadataMapPtr metadata_map_{new Http::MetadataMap()};
-  std::unordered_map<std::string, uint64_t> duplicated_metadata_key_count_;
+  absl::node_hash_map<std::string, uint64_t> duplicated_metadata_key_count_;
   bool waiting_for_end_stream_{};
   bool saw_end_stream_{};
   std::string body_;
diff --git a/test/integration/protocol_integration_test.cc b/test/integration/protocol_integration_test.cc
index 1078a1bfe6ff..fc5b7aa80642 100644
--- a/test/integration/protocol_integration_test.cc
+++ b/test/integration/protocol_integration_test.cc
@@ -974,7 +974,7 @@ TEST_P(ProtocolIntegrationTest, HeadersWithUnderscoresCauseRequestRejectedByDefa
     response->waitForReset();
     codec_client_->close();
     ASSERT_TRUE(response->reset());
-    EXPECT_EQ(Http::StreamResetReason::RemoteReset, response->reset_reason());
+    EXPECT_EQ(Http::StreamResetReason::RemoteReset, response->resetReason());
   }
   EXPECT_THAT(waitForAccessLog(access_log_name_), HasSubstr("unexpected_underscore"));
 }
@@ -1115,7 +1115,7 @@ TEST_P(DownstreamProtocolIntegrationTest, InvalidContentLength) {
     test_server_->waitForCounterGe("http.config_test.downstream_rq_4xx", 1);
   } else {
     ASSERT_TRUE(response->reset());
-    EXPECT_EQ(Http::StreamResetReason::ConnectionTermination, response->reset_reason());
+    EXPECT_EQ(Http::StreamResetReason::ConnectionTermination, response->resetReason());
   }
 }
 
@@ -1152,7 +1152,7 @@ TEST_P(DownstreamProtocolIntegrationTest, InvalidContentLengthAllowed) {
     EXPECT_EQ("400", response->headers().getStatusValue());
   } else {
     ASSERT_TRUE(response->reset());
-    EXPECT_EQ(Http::StreamResetReason::RemoteReset, response->reset_reason());
+    EXPECT_EQ(Http::StreamResetReason::RemoteReset, response->resetReason());
   }
 }
 
@@ -1173,7 +1173,7 @@ TEST_P(DownstreamProtocolIntegrationTest, MultipleContentLengths) {
     EXPECT_EQ("400", response->headers().getStatusValue());
   } else {
     ASSERT_TRUE(response->reset());
-    EXPECT_EQ(Http::StreamResetReason::ConnectionTermination, response->reset_reason());
+    EXPECT_EQ(Http::StreamResetReason::ConnectionTermination, response->resetReason());
   }
 }
 
@@ -1208,7 +1208,7 @@ TEST_P(DownstreamProtocolIntegrationTest, MultipleContentLengthsAllowed) {
     EXPECT_EQ("400", response->headers().getStatusValue());
   } else {
     ASSERT_TRUE(response->reset());
-    EXPECT_EQ(Http::StreamResetReason::RemoteReset, response->reset_reason());
+    EXPECT_EQ(Http::StreamResetReason::RemoteReset, response->resetReason());
   }
 }
 
diff --git a/test/integration/xfcc_integration_test.cc b/test/integration/xfcc_integration_test.cc
index 2b87808c372c..e14ee0ef7e30 100644
--- a/test/integration/xfcc_integration_test.cc
+++ b/test/integration/xfcc_integration_test.cc
@@ -2,7 +2,6 @@
 
 #include <memory>
 #include <regex>
-#include <unordered_map>
 
 #include "envoy/config/bootstrap/v3/bootstrap.pb.h"
 #include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
@@ -21,6 +20,7 @@
 #include "test/test_common/printers.h"
 #include "test/test_common/utility.h"
 
+#include "absl/container/node_hash_map.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "integration.h"
@@ -429,8 +429,8 @@ TEST_P(XfccIntegrationTest, TagExtractedNameGenerationTest) {
   // }
   // std::cout << "};" << std::endl;
 
-  std::unordered_map<std::string, std::string> tag_extracted_counter_map;
-  std::unordered_map<std::string, std::string> tag_extracted_gauge_map;
+  absl::node_hash_map<std::string, std::string> tag_extracted_counter_map;
+  absl::node_hash_map<std::string, std::string> tag_extracted_gauge_map;
 
   tag_extracted_counter_map = {
       {listenerStatPrefix("downstream_cx_total"), "listener.downstream_cx_total"},
@@ -748,7 +748,7 @@ TEST_P(XfccIntegrationTest, TagExtractedNameGenerationTest) {
       {"server.version", "server.version"}};
 
   auto test_name_against_mapping =
-      [](const std::unordered_map<std::string, std::string>& extracted_name_map,
+      [](const absl::node_hash_map<std::string, std::string>& extracted_name_map,
          const Stats::Metric& metric) {
         auto it = extracted_name_map.find(metric.name());
         // Ignore any metrics that are not found in the map for ease of addition
diff --git a/test/mocks/runtime/mocks.h b/test/mocks/runtime/mocks.h
index 8d99b4bc402d..53bea8ce81ad 100644
--- a/test/mocks/runtime/mocks.h
+++ b/test/mocks/runtime/mocks.h
@@ -2,7 +2,6 @@
 
 #include <cstdint>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/runtime/runtime.h"
 #include "envoy/type/v3/percent.pb.h"
@@ -10,6 +9,7 @@
 
 #include "test/mocks/stats/mocks.h"
 
+#include "absl/container/node_hash_map.h"
 #include "gmock/gmock.h"
 
 namespace Envoy {
@@ -65,7 +65,7 @@ class MockLoader : public Loader {
   MOCK_METHOD(void, initialize, (Upstream::ClusterManager & cm));
   MOCK_METHOD(const Snapshot&, snapshot, ());
   MOCK_METHOD(SnapshotConstSharedPtr, threadsafeSnapshot, ());
-  MOCK_METHOD(void, mergeValues, ((const std::unordered_map<std::string, std::string>&)));
+  MOCK_METHOD(void, mergeValues, ((const absl::node_hash_map<std::string, std::string>&)));
   MOCK_METHOD(void, startRtdsSubscriptions, (ReadyCallback));
   MOCK_METHOD(Stats::Scope&, getRootScope, ());
 
diff --git a/test/mocks/server/config_tracker.h b/test/mocks/server/config_tracker.h
index 09f516f0e03c..1c30cf919c76 100644
--- a/test/mocks/server/config_tracker.h
+++ b/test/mocks/server/config_tracker.h
@@ -4,6 +4,7 @@
 
 #include "envoy/server/config_tracker.h"
 
+#include "absl/container/node_hash_map.h"
 #include "gmock/gmock.h"
 
 namespace Envoy {
@@ -23,7 +24,7 @@ class MockConfigTracker : public ConfigTracker {
     return EntryOwnerPtr{add_(key, std::move(callback))};
   }
 
-  std::unordered_map<std::string, Cb> config_tracker_callbacks_;
+  absl::node_hash_map<std::string, Cb> config_tracker_callbacks_;
 };
 } // namespace Server
 } // namespace Envoy
diff --git a/test/mocks/thread_local/mocks.h b/test/mocks/thread_local/mocks.h
index a4a68cf6881d..9bbd26a64465 100644
--- a/test/mocks/thread_local/mocks.h
+++ b/test/mocks/thread_local/mocks.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include <cstdint>
-#include <unordered_map>
 
 #include "envoy/thread_local/thread_local.h"
 
diff --git a/test/mocks/upstream/cluster_info.h b/test/mocks/upstream/cluster_info.h
index e8f3d47869ca..8af0bfcb39df 100644
--- a/test/mocks/upstream/cluster_info.h
+++ b/test/mocks/upstream/cluster_info.h
@@ -60,7 +60,7 @@ class MockClusterTypedMetadata : public Config::TypedMetadataImpl<ClusterTypedMe
     data_[key] = std::move(value);
   }
 
-  std::unordered_map<std::string, std::unique_ptr<const TypedMetadata::Object>>& data() {
+  absl::node_hash_map<std::string, std::unique_ptr<const TypedMetadata::Object>>& data() {
     return data_;
   }
 };
diff --git a/test/server/admin/admin_test.cc b/test/server/admin/admin_test.cc
index 0281af125fb9..478354eea707 100644
--- a/test/server/admin/admin_test.cc
+++ b/test/server/admin/admin_test.cc
@@ -2,7 +2,6 @@
 #include <fstream>
 #include <memory>
 #include <regex>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/admin/v3/clusters.pb.h"
diff --git a/test/server/admin/runtime_handler_test.cc b/test/server/admin/runtime_handler_test.cc
index ec8c0953fc13..dfd7fc0bf1f9 100644
--- a/test/server/admin/runtime_handler_test.cc
+++ b/test/server/admin/runtime_handler_test.cc
@@ -81,7 +81,7 @@ TEST_P(AdminInstanceTest, RuntimeModify) {
   Runtime::MockLoader loader;
   EXPECT_CALL(server_, runtime()).WillRepeatedly(testing::ReturnPointee(&loader));
 
-  std::unordered_map<std::string, std::string> overrides;
+  absl::node_hash_map<std::string, std::string> overrides;
   overrides["foo"] = "bar";
   overrides["x"] = "42";
   overrides["nothing"] = "";
@@ -97,7 +97,7 @@ TEST_P(AdminInstanceTest, RuntimeModifyParamsInBody) {
 
   const std::string key = "routing.traffic_shift.foo";
   const std::string value = "numerator: 1\ndenominator: TEN_THOUSAND\n";
-  const std::unordered_map<std::string, std::string> overrides = {{key, value}};
+  const absl::node_hash_map<std::string, std::string> overrides = {{key, value}};
   EXPECT_CALL(loader, mergeValues(overrides)).Times(1);
 
   const std::string body = fmt::format("{}={}", key, value);
diff --git a/test/server/filter_chain_benchmark_test.cc b/test/server/filter_chain_benchmark_test.cc
index dbd24ecff6cc..a04047346b30 100644
--- a/test/server/filter_chain_benchmark_test.cc
+++ b/test/server/filter_chain_benchmark_test.cc
@@ -1,5 +1,4 @@
 #include <iostream>
-#include <unordered_map>
 
 #include "envoy/config/listener/v3/listener.pb.h"
 #include "envoy/config/listener/v3/listener_components.pb.h"
diff --git a/test/test_common/environment.cc b/test/test_common/environment.cc
index 4d65f0e78617..9269cc73bcce 100644
--- a/test/test_common/environment.cc
+++ b/test/test_common/environment.cc
@@ -5,7 +5,6 @@
 #include <regex>
 #include <sstream>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/common/platform.h"
@@ -17,6 +16,8 @@
 #include "common/common/utility.h"
 #include "common/filesystem/directory.h"
 
+#include "absl/container/node_hash_map.h"
+
 #ifdef ENVOY_HANDLE_SIGNALS
 #include "common/signal/signal_action.h"
 #endif
@@ -289,7 +290,7 @@ const std::string TestEnvironment::unixDomainSocketDirectory() {
 
 std::string TestEnvironment::substitute(const std::string& str,
                                         Network::Address::IpVersion version) {
-  const std::unordered_map<std::string, std::string> path_map = {
+  const absl::node_hash_map<std::string, std::string> path_map = {
       {"test_tmpdir", TestEnvironment::temporaryDirectory()},
       {"test_udsdir", TestEnvironment::unixDomainSocketDirectory()},
       {"test_rundir", runfiles_ != nullptr ? TestEnvironment::runfilesDirectory() : "invalid"},
diff --git a/test/test_common/environment.h b/test/test_common/environment.h
index 02b324ef5191..9434c59b7e6a 100644
--- a/test/test_common/environment.h
+++ b/test/test_common/environment.h
@@ -2,7 +2,6 @@
 
 #include <cstdint>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "envoy/network/address.h"
@@ -10,6 +9,7 @@
 
 #include "common/json/json_loader.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
@@ -18,9 +18,9 @@
 namespace Envoy {
 class TestEnvironment {
 public:
-  using PortMap = std::unordered_map<std::string, uint32_t>;
+  using PortMap = absl::node_hash_map<std::string, uint32_t>;
 
-  using ParamMap = std::unordered_map<std::string, std::string>;
+  using ParamMap = absl::node_hash_map<std::string, std::string>;
 
   /**
    * Perform common initialization steps needed to run a test binary. This
diff --git a/test/tools/router_check/router.cc b/test/tools/router_check/router.cc
index e1aaf0782e3c..e79671f255d2 100644
--- a/test/tools/router_check/router.cc
+++ b/test/tools/router_check/router.cc
@@ -3,7 +3,6 @@
 #include <functional>
 #include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "envoy/config/core/v3/base.pb.h"
 #include "envoy/config/route/v3/route.pb.h"
diff --git a/tools/clang_tools/api_booster/BUILD b/tools/clang_tools/api_booster/BUILD
index 296e318c01fe..d6affe19640b 100644
--- a/tools/clang_tools/api_booster/BUILD
+++ b/tools/clang_tools/api_booster/BUILD
@@ -24,6 +24,7 @@ clang_tools_cc_library(
     srcs = ["proto_cxx_utils.cc"],
     hdrs = ["proto_cxx_utils.h"],
     deps = [
+        "@com_google_absl//absl/container:node_hash_map",
         "@com_google_absl//absl/strings",
         "@com_google_absl//absl/types:optional",
     ],
diff --git a/tools/clang_tools/api_booster/main.cc b/tools/clang_tools/api_booster/main.cc
index b71d9542752e..976ddc969fcd 100644
--- a/tools/clang_tools/api_booster/main.cc
+++ b/tools/clang_tools/api_booster/main.cc
@@ -27,6 +27,7 @@
 
 #include "tools/type_whisperer/api_type_db.h"
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/str_cat.h"
 
 // Enable to see debug log messages.
@@ -243,7 +244,7 @@ class ApiBooster : public clang::ast_matchers::MatchFinder::MatchCallback,
                        const clang::SourceManager& source_manager) {
     auto* direct_callee = call_expr.getDirectCallee();
     if (direct_callee != nullptr) {
-      const std::unordered_map<std::string, int> ValidateNameToArg = {
+      const absl::node_hash_map<std::string, int> ValidateNameToArg = {
           {"loadFromYamlAndValidate", 1},
           {"loadFromFileAndValidate", 1},
           {"downcastAndValidate", -1},
diff --git a/tools/clang_tools/api_booster/proto_cxx_utils.cc b/tools/clang_tools/api_booster/proto_cxx_utils.cc
index 42cc92e7c4c4..194bdc0e6bf7 100644
--- a/tools/clang_tools/api_booster/proto_cxx_utils.cc
+++ b/tools/clang_tools/api_booster/proto_cxx_utils.cc
@@ -40,10 +40,10 @@ std::string ProtoCxxUtils::protoToCxxType(const std::string& proto_type_name, bo
 
 absl::optional<std::string>
 ProtoCxxUtils::renameMethod(absl::string_view method_name,
-                            const std::unordered_map<std::string, std::string> renames) {
+                            const absl::node_hash_map<std::string, std::string> renames) {
   // Simple O(N * M) match, where M is constant (the set of prefixes/suffixes) so
   // should be fine.
-  for (const auto field_rename : renames) {
+  for (const auto& field_rename : renames) {
     const std::vector<std::string> GeneratedMethodPrefixes = {
         "clear_", "set_", "has_", "mutable_", "set_allocated_", "release_", "add_", "",
     };
@@ -63,7 +63,7 @@ ProtoCxxUtils::renameMethod(absl::string_view method_name,
 
 absl::optional<std::string>
 ProtoCxxUtils::renameConstant(absl::string_view constant_name,
-                              const std::unordered_map<std::string, std::string> renames) {
+                              const absl::node_hash_map<std::string, std::string> renames) {
   if (constant_name.size() < 2 || constant_name[0] != 'k' || !isupper(constant_name[1])) {
     return {};
   }
@@ -91,7 +91,7 @@ ProtoCxxUtils::renameConstant(absl::string_view constant_name,
 
 absl::optional<std::string>
 ProtoCxxUtils::renameEnumValue(absl::string_view enum_value_name,
-                               const std::unordered_map<std::string, std::string> renames) {
+                               const absl::node_hash_map<std::string, std::string> renames) {
   const auto it = renames.find(std::string(enum_value_name));
   if (it == renames.cend()) {
     return {};
diff --git a/tools/clang_tools/api_booster/proto_cxx_utils.h b/tools/clang_tools/api_booster/proto_cxx_utils.h
index 22b816455bc9..10eff61a7910 100644
--- a/tools/clang_tools/api_booster/proto_cxx_utils.h
+++ b/tools/clang_tools/api_booster/proto_cxx_utils.h
@@ -1,8 +1,8 @@
 #pragma once
 
 #include <regex>
-#include <unordered_map>
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
 #include "absl/types/optional.h"
@@ -25,18 +25,18 @@ class ProtoCxxUtils {
   // field in proto, and if so, return the new method name.
   static absl::optional<std::string>
   renameMethod(absl::string_view method_name,
-               const std::unordered_map<std::string, std::string> renames);
+               const absl::node_hash_map<std::string, std::string> renames);
 
   // Given a constant, e.g. kFooBar, determine if it needs upgrading. We need
   // this for synthesized oneof cases.
   static absl::optional<std::string>
   renameConstant(absl::string_view constant_name,
-                 const std::unordered_map<std::string, std::string> renames);
+                 const absl::node_hash_map<std::string, std::string> renames);
 
   // Given an enum value, e.g. FOO_BAR determine if it needs upgrading.
   static absl::optional<std::string>
   renameEnumValue(absl::string_view enum_value_name,
-                  const std::unordered_map<std::string, std::string> renames);
+                  const absl::node_hash_map<std::string, std::string> renames);
 
   // Convert from a protobuf type, e.g. foo.bar.v2, to a C++ type, e.g.
   // foo::bar::v2.
diff --git a/tools/clang_tools/api_booster/proto_cxx_utils_test.cc b/tools/clang_tools/api_booster/proto_cxx_utils_test.cc
index 6b4e0789ba10..2a06413bd4d2 100644
--- a/tools/clang_tools/api_booster/proto_cxx_utils_test.cc
+++ b/tools/clang_tools/api_booster/proto_cxx_utils_test.cc
@@ -1,5 +1,3 @@
-#include <unordered_map>
-
 #include "gtest/gtest.h"
 #include "proto_cxx_utils.h"
 
@@ -32,7 +30,7 @@ TEST(ProtoCxxUtils, ProtoToCxxType) {
 
 // Validate proto field accessor upgrades.
 TEST(ProtoCxxUtils, RenameMethod) {
-  const std::unordered_map<std::string, std::string> renames = {
+  const absl::node_hash_map<std::string, std::string> renames = {
       {"foo", "bar"},
       {"bar", "baz"},
   };
@@ -52,7 +50,7 @@ TEST(ProtoCxxUtils, RenameMethod) {
 
 // Validate proto constant upgrades.
 TEST(ProtoCxxUtils, RenameConstant) {
-  const std::unordered_map<std::string, std::string> renames = {
+  const absl::node_hash_map<std::string, std::string> renames = {
       {"foo_bar", "bar_foo"},
       {"foo_baz", "baz"},
   };
@@ -63,7 +61,7 @@ TEST(ProtoCxxUtils, RenameConstant) {
 
 // Validate proto enum value upgrades.
 TEST(ProtoCxxUtils, RenameEnumValue) {
-  const std::unordered_map<std::string, std::string> renames = {
+  const absl::node_hash_map<std::string, std::string> renames = {
       {"FOO_BAR", "BAR_FOO"},
   };
   EXPECT_EQ(absl::nullopt, ProtoCxxUtils::renameEnumValue("FOO_BAZ", renames));
diff --git a/tools/code_format/check_format.py b/tools/code_format/check_format.py
index b647b827fc3c..d38b731a0e47 100755
--- a/tools/code_format/check_format.py
+++ b/tools/code_format/check_format.py
@@ -647,6 +647,15 @@ def checkSourceLine(line, file_path, reportError):
     reportError("Don't use strptime; use absl::FormatTime instead")
   if tokenInLine("strerror", line):
     reportError("Don't use strerror; use Envoy::errorDetails instead")
+  # Prefer using abseil hash maps/sets over std::unordered_map/set for performance optimizations and
+  # non-deterministic iteration order that exposes faulty assertions.
+  # See: https://abseil.io/docs/cpp/guides/container#hash-tables
+  if "std::unordered_map" in line:
+    reportError("Don't use std::unordered_map; use absl::flat_hash_map instead or "
+                "absl::node_hash_map if pointer stability of keys/values is required")
+  if "std::unordered_set" in line:
+    reportError("Don't use std::unordered_set; use absl::flat_hash_set instead or "
+                "absl::node_hash_set if pointer stability of keys/values is required")
   if "std::atomic_" in line:
     # The std::atomic_* free functions are functionally equivalent to calling
     # operations on std::atomic<T> objects, so prefer to use that instead.
diff --git a/tools/code_format/check_format_test_helper.py b/tools/code_format/check_format_test_helper.py
index acf2cd9f8700..9cb00aa50f86 100755
--- a/tools/code_format/check_format_test_helper.py
+++ b/tools/code_format/check_format_test_helper.py
@@ -232,6 +232,12 @@ def runChecks():
       "Registry::InjectFactory instead.")
   errors += checkUnfixableError("strerror.cc",
                                 "Don't use strerror; use Envoy::errorDetails instead")
+  errors += checkUnfixableError(
+      "std_unordered_map.cc", "Don't use std::unordered_map; use absl::flat_hash_map instead " +
+      "or absl::node_hash_map if pointer stability of keys/values is required")
+  errors += checkUnfixableError(
+      "std_unordered_set.cc", "Don't use std::unordered_set; use absl::flat_hash_set instead " +
+      "or absl::node_hash_set if pointer stability of keys/values is required")
 
   # The following files have errors that can be automatically fixed.
   errors += checkAndFixError("over_enthusiastic_spaces.cc",
diff --git a/tools/testdata/check_format/std_unordered_map.cc b/tools/testdata/check_format/std_unordered_map.cc
new file mode 100644
index 000000000000..ed838faf2cd8
--- /dev/null
+++ b/tools/testdata/check_format/std_unordered_map.cc
@@ -0,0 +1,7 @@
+#include <unordered_map>
+
+namespace Envoy {
+
+std::unordered_map<int, int> foo;
+
+} // namespace Envoy
diff --git a/tools/testdata/check_format/std_unordered_set.cc b/tools/testdata/check_format/std_unordered_set.cc
new file mode 100644
index 000000000000..258bed7836c8
--- /dev/null
+++ b/tools/testdata/check_format/std_unordered_set.cc
@@ -0,0 +1,7 @@
+#include <unordered_set>
+
+namespace Envoy {
+
+std::unordered_set<int, int> foo;
+
+} // namespace Envoy
diff --git a/tools/type_whisperer/BUILD b/tools/type_whisperer/BUILD
index 4b2b7735de55..27463e42a4c6 100644
--- a/tools/type_whisperer/BUILD
+++ b/tools/type_whisperer/BUILD
@@ -101,6 +101,7 @@ envoy_cc_library(
         "//source/common/protobuf",
         "//tools/type_whisperer:api_type_db_proto_cc_proto",
         "@com_github_cncf_udpa//udpa/annotations:pkg_cc_proto",
+        "@com_google_absl//absl/container:node_hash_map",
     ],
 )
 
diff --git a/tools/type_whisperer/api_type_db.h b/tools/type_whisperer/api_type_db.h
index cec5627588ea..853364646e8c 100644
--- a/tools/type_whisperer/api_type_db.h
+++ b/tools/type_whisperer/api_type_db.h
@@ -1,8 +1,8 @@
 #pragma once
 
 #include <string>
-#include <unordered_map>
 
+#include "absl/container/node_hash_map.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
@@ -25,7 +25,7 @@ struct TypeInformation {
   const bool enum_type_;
 
   // Field or enum value renames.
-  std::unordered_map<std::string, std::string> renames_;
+  absl::node_hash_map<std::string, std::string> renames_;
 };
 
 // We don't expose the raw API type database to consumers, as this requires RTTI