diff --git a/api/bazel/repository_locations.bzl b/api/bazel/repository_locations.bzl
index 3ca672210274..d644e281dd3c 100644
--- a/api/bazel/repository_locations.bzl
+++ b/api/bazel/repository_locations.bzl
@@ -155,12 +155,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "envoy_toolshed",
         project_desc = "Tooling, libraries, runners and checkers for Envoy proxy's CI",
         project_url = "https://github.com/envoyproxy/toolshed",
-        version = "0.0.9",
-        sha256 = "f1a2169d271efbf4de2b24207136c5009c5453fba62ba8dc3497cba204d092aa",
+        version = "0.0.10",
+        sha256 = "bdfcf0a23c18a99887ac25761aa56d85bedb6eda77c89f9f19e6142b812749b9",
         strip_prefix = "toolshed-bazel-v{version}/bazel",
         urls = ["https://github.com/envoyproxy/toolshed/archive/bazel-v{version}.tar.gz"],
         use_category = ["build"],
-        release_date = "2023-09-28",
+        release_date = "2023-10-02",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/envoyproxy/envoy/blob/bazel-v{version}/LICENSE",
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index e63cc80be0e7..c3a6360a7b40 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -648,8 +648,6 @@ case $CI_TARGET in
         setup_clang_toolchain
         echo "generating docs..."
         # Build docs.
-        # We want the binary at the end
-        BAZEL_BUILD_OPTIONS+=(--remote_download_toplevel)
         [[ -z "${DOCS_OUTPUT_DIR}" ]] && DOCS_OUTPUT_DIR=generated/docs
         rm -rf "${DOCS_OUTPUT_DIR}"
         mkdir -p "${DOCS_OUTPUT_DIR}"
@@ -661,8 +659,12 @@ case $CI_TARGET in
             bazel "${BAZEL_STARTUP_OPTIONS[@]}" build "${BAZEL_BUILD_OPTIONS[@]}" //docs:rst
             cp bazel-bin/docs/rst.tar.gz "$DOCS_OUTPUT_DIR"/envoy-docs-rst.tar.gz
         fi
-        bazel "${BAZEL_STARTUP_OPTIONS[@]}" build "${BAZEL_BUILD_OPTIONS[@]}" //docs:html
-        tar -xzf bazel-bin/docs/html.tar.gz -C "$DOCS_OUTPUT_DIR"
+        DOCS_OUTPUT_DIR="$(realpath "$DOCS_OUTPUT_DIR")"
+        bazel "${BAZEL_STARTUP_OPTIONS[@]}" run \
+              "${BAZEL_BUILD_OPTIONS[@]}" \
+              --//tools/tarball:target=//docs:html \
+              //tools/tarball:unpack \
+              "$DOCS_OUTPUT_DIR"
         ;;
 
     docs-upload)
diff --git a/mobile/docs/build.sh b/mobile/docs/build.sh
index 5e86fd5471a3..c53756660690 100755
--- a/mobile/docs/build.sh
+++ b/mobile/docs/build.sh
@@ -30,6 +30,7 @@ rm -rf "${DOCS_OUTPUT_DIR}"
 mkdir -p "${DOCS_OUTPUT_DIR}"
 DOCS_OUTPUT_DIR="$(realpath "$DOCS_OUTPUT_DIR")"
 
-./bazelw build "$DOCS_TARGET"
-
-tar xf bazel-bin/docs/html.tar.gz -C "$DOCS_OUTPUT_DIR" .
+./bazelw run \
+         "--@envoy//tools/tarball:target=$DOCS_TARGET" \
+         @envoy//tools/tarball:unpack \
+         "$DOCS_OUTPUT_DIR"
diff --git a/mobile/docs/publish.sh b/mobile/docs/publish.sh
index 9f452aa9223e..03b40a059e77 100755
--- a/mobile/docs/publish.sh
+++ b/mobile/docs/publish.sh
@@ -34,5 +34,8 @@ git -C "${MOBILE_DOCS_CHECKOUT_DIR}" config user.name "envoy-mobile-docs(ci)"
 git -C "${MOBILE_DOCS_CHECKOUT_DIR}" config user.email envoy-mobile-docs@users.noreply.github.com
 echo 'add'
 git -C "${MOBILE_DOCS_CHECKOUT_DIR}" add .
-echo 'commit'
-git -C "${MOBILE_DOCS_CHECKOUT_DIR}" commit -m "docs envoy-mobile@$BUILD_SHA"
+
+if [[ "$(git -C "${MOBILE_DOCS_CHECKOUT_DIR}" status --porcelain)" ]]; then
+    echo 'commit'
+    git -C "${MOBILE_DOCS_CHECKOUT_DIR}" commit -m "docs envoy-mobile@$BUILD_SHA"
+fi
diff --git a/tools/tarball/BUILD b/tools/tarball/BUILD
new file mode 100644
index 000000000000..069d4eee6b27
--- /dev/null
+++ b/tools/tarball/BUILD
@@ -0,0 +1,8 @@
+load("@envoy_toolshed//tarball:macros.bzl", "unpacker")
+
+licenses(["notice"])  # Apache 2
+
+unpacker(
+    name = "unpack",
+    zstd = "//tools/zstd",
+)