diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 30ed536530ed..83b51e4e32f0 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -51,17 +51,20 @@ jobs:
           ciTarget: bazel.release
 
   - job: release_arm64
-    displayName: "Linux-arm64 release.server_only"
+    displayName: "Linux-arm64 release"
     dependsOn: ["format"]
-    condition: ne(variables['Build.Reason'], 'PullRequest')
+    # For master builds, continue even if format fails
+    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
+    timeoutInMinutes: 360
     pool: "arm-large"
     steps:
       - template: bazel.yml
         parameters:
           managedAgent: false
-          ciTarget: bazel.release.server_only
+          ciTarget: bazel.release
           rbe: false
           artifactSuffix: ".arm64"
+          bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
 
   - job: bazel
     displayName: "Linux-x64"
diff --git a/.bazelrc b/.bazelrc
index 2a9d4f0943e5..6e28a801838a 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -23,6 +23,7 @@ build --enable_platform_specific_config
 # Enable position independent code, this option is not supported on Windows and default on on macOS.
 build:linux --copt=-fPIC
 build:linux --cxxopt=-std=c++17
+build:linux --conlyopt=-fexceptions
 
 # We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
 build --define absl=1
diff --git a/ci/build_setup.sh b/ci/build_setup.sh
index 97419a425618..d8a62e1c8193 100755
--- a/ci/build_setup.sh
+++ b/ci/build_setup.sh
@@ -92,6 +92,8 @@ export BAZEL_BUILD_OPTIONS="--verbose_failures ${BAZEL_OPTIONS} --action_env=HOM
   --repository_cache=${BUILD_DIR}/repository_cache --experimental_repository_cache_hardlinks \
   ${BAZEL_BUILD_EXTRA_OPTIONS} ${BAZEL_EXTRA_TEST_OPTIONS}"
 
+[[ "$(uname -m)" == "aarch64" ]] && BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS} --define=hot_restart=disabled --test_env=HEAPCHECK="
+
 [[ "${BAZEL_EXPUNGE}" == "1" ]] && "${BAZEL}" clean --expunge
 
 # Also setup some space for building Envoy standalone.
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 344026c5e88e..620efefb8cc1 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -110,7 +110,7 @@ if [[ "$CI_TARGET" == "bazel.release" ]]; then
   # toolchain is kept consistent. This ifdef is checked in
   # test/common/stats/stat_test_utility.cc when computing
   # Stats::TestUtil::MemoryTest::mode().
-  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS} --test_env=ENVOY_MEMORY_TEST_EXACT=true"
+  [[ "$(uname -m)" == "x86_64" ]] && BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS} --test_env=ENVOY_MEMORY_TEST_EXACT=true"
 
   setup_clang_toolchain
   echo "bazel release build with tests..."