diff --git a/api/bazel/repository_locations.bzl b/api/bazel/repository_locations.bzl
index 427f403771be..3f4e3b57a3a0 100644
--- a/api/bazel/repository_locations.bzl
+++ b/api/bazel/repository_locations.bzl
@@ -145,12 +145,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "envoy_toolshed",
         project_desc = "Tooling, libraries, runners and checkers for Envoy proxy's CI",
         project_url = "https://github.com/envoyproxy/toolshed",
-        version = "0.0.6",
-        sha256 = "7047db983e49290ac14b2733459d439a8a521ff49e95fbd0b185a692bd6a6d86",
+        version = "0.0.10",
+        sha256 = "bdfcf0a23c18a99887ac25761aa56d85bedb6eda77c89f9f19e6142b812749b9",
         strip_prefix = "toolshed-bazel-v{version}/bazel",
         urls = ["https://github.com/envoyproxy/toolshed/archive/bazel-v{version}.tar.gz"],
         use_category = ["build"],
-        release_date = "2023-09-24",
+        release_date = "2023-10-02",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/envoyproxy/envoy/blob/bazel-v{version}/LICENSE",
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index b8a3b3efde86..132d8b3fdba2 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -617,8 +617,6 @@ case $CI_TARGET in
         setup_clang_toolchain
         echo "generating docs..."
         # Build docs.
-        # We want the binary at the end
-        BAZEL_BUILD_OPTIONS+=(--remote_download_toplevel)
         [[ -z "${DOCS_OUTPUT_DIR}" ]] && DOCS_OUTPUT_DIR=generated/docs
         rm -rf "${DOCS_OUTPUT_DIR}"
         mkdir -p "${DOCS_OUTPUT_DIR}"
@@ -630,8 +628,12 @@ case $CI_TARGET in
             bazel "${BAZEL_STARTUP_OPTIONS[@]}" build "${BAZEL_BUILD_OPTIONS[@]}" //docs:rst
             cp bazel-bin/docs/rst.tar.gz "$DOCS_OUTPUT_DIR"/envoy-docs-rst.tar.gz
         fi
-        bazel "${BAZEL_STARTUP_OPTIONS[@]}" build "${BAZEL_BUILD_OPTIONS[@]}" //docs:html
-        tar -xzf bazel-bin/docs/html.tar.gz -C "$DOCS_OUTPUT_DIR"
+        DOCS_OUTPUT_DIR="$(realpath "$DOCS_OUTPUT_DIR")"
+        bazel "${BAZEL_STARTUP_OPTIONS[@]}" run \
+              "${BAZEL_BUILD_OPTIONS[@]}" \
+              --//tools/tarball:target=//docs:html \
+              //tools/tarball:unpack \
+              "$DOCS_OUTPUT_DIR"
         ;;
 
     docs-upload)
diff --git a/mobile/docs/publish.sh b/mobile/docs/publish.sh
deleted file mode 100755
index dc821274f934..000000000000
--- a/mobile/docs/publish.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/bin/bash
-
-# This is run on every commit that GitHub Actions picks up. It assumes that docs have already been
-# built via docs/build.sh. The push behavior differs depending on the nature of the commit:
-# * Tag commit (e.g. v1.6.0): pushes docs to versioned location.
-# * Main commit: pushes docs to latest. Note that envoy-mobile.github.io uses `master` rather than
-#                `main` because using `main` as the default branch currently results in 404s.
-# * Otherwise: noop.
-
-set -e
-
-DOCS_DIR=generated/docs
-CHECKOUT_DIR=../envoy-mobile-docs
-BUILD_SHA="$(git rev-parse HEAD)"
-
-if [ "$GITHUB_REF_TYPE" == "tag" ]
-then
-  PUBLISH_DIR="$CHECKOUT_DIR"/docs/envoy-mobile/"$GITHUB_REF_NAME"
-elif [ "$GITHUB_REF_NAME" == "main" ]
-then
-  PUBLISH_DIR="$CHECKOUT_DIR"/docs/envoy-mobile/latest
-else
-  echo "Ignoring docs push"
-  exit 0
-fi
-
-echo 'cloning'
-git clone git@github.com:envoy-mobile/envoy-mobile.github.io "$CHECKOUT_DIR"
-
-git -C "$CHECKOUT_DIR" fetch
-git -C "$CHECKOUT_DIR" checkout -B master origin/master
-rm -fr "$PUBLISH_DIR"
-mkdir -p "$PUBLISH_DIR"
-cp -r "$DOCS_DIR"/* "$PUBLISH_DIR"
-cd "$CHECKOUT_DIR"
-
-git config user.name "envoy-mobile-docs(ci)"
-git config user.email envoy-mobile-docs@users.noreply.github.com
-echo 'add'
-git add .
-echo 'commit'
-git commit -m "docs envoy-mobile@$BUILD_SHA"
-echo 'push'
-git push origin master
diff --git a/tools/tarball/BUILD b/tools/tarball/BUILD
new file mode 100644
index 000000000000..069d4eee6b27
--- /dev/null
+++ b/tools/tarball/BUILD
@@ -0,0 +1,8 @@
+load("@envoy_toolshed//tarball:macros.bzl", "unpacker")
+
+licenses(["notice"])  # Apache 2
+
+unpacker(
+    name = "unpack",
+    zstd = "//tools/zstd",
+)