diff --git a/tools/update-sha.sh b/tools/update-sha.sh
index 7641ee64..91958d54 100755
--- a/tools/update-sha.sh
+++ b/tools/update-sha.sh
@@ -6,15 +6,20 @@ set -o nounset
 set -o xtrace
 
 function find_sha() {
-  local CONTENT=$1
-  local DEPENDENCY=$2
-  echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 "version =" | awk '{ print $3 }' | tr -d '"' | tr -d ","
-}
-
-function find_date() {
-  local CONTENT=$1
-  local DEPENDENCY=$2
-  echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 "release_date =" | awk '{ print $3 }' | tr -d '"' | tr -d "," || true
+  local MODULE=$1
+  local SOURCE_JSON ARCHIVE_URL REVISION
+  SOURCE_JSON=$(
+    jq -r '.registryFileHashes | keys[]' <<< "$LOCKFILE" |
+      grep -F "/modules/$MODULE/" |
+      grep '/source.json$'
+  )
+
+  ARCHIVE_URL=$(curl -fsSL "$SOURCE_JSON" | jq -er '.url')
+
+  REVISION=${ARCHIVE_URL##*/}   # Keep only the filename, e.g. v1.8.0.tar.gz.
+  REVISION=${REVISION%.tar.gz}  # Remove .tar.gz if present.
+  REVISION=${REVISION%.zip}     # Remove .zip if present.
+  echo "${REVISION#v}"         # Remove a leading v and print the revision for the caller.
 }
 
 function find_envoy_sha_from_tag() {
@@ -25,38 +30,30 @@ function find_envoy_sha_from_tag() {
 CURRENT_ENVOY_RELEASE=$(cat envoy_release)
 ENVOY_VERSION=$(find_envoy_sha_from_tag "$1")
 
-CURL_OUTPUT=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/bazel/repository_locations.bzl")
-
-GOOGLEAPIS_SHA=$(find_sha "$CURL_OUTPUT" com_google_googleapis)
-GOOGLEAPIS_DATE=$(find_date "$CURL_OUTPUT" com_google_googleapis)
-
-PGV_GIT_SHA=$(find_sha "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate)
-PGV_GIT_DATE=$(find_date "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate)
-
-PROMETHEUS_SHA=$(find_sha "$CURL_OUTPUT" prometheus_metrics_model)
-PROMETHEUS_DATE=$(find_date "$CURL_OUTPUT" prometheus_metrics_model)
-
-XDS_SHA=$(find_sha "$CURL_OUTPUT" "xds = dict")
-XDS_DATE=$(find_date "$CURL_OUTPUT" "xds = dict")
-
-OPENTELEMETRY_SHA=$(find_sha "$CURL_OUTPUT" opentelemetry_proto)
-OPENTELEMETRY_DATE=$(find_date "$CURL_OUTPUT" opentelemetry_proto)
+LOCKFILE=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/MODULE.bazel.lock")
 
-CEL_SHA=$(find_sha "$CURL_OUTPUT" dev_cel)
-CEL_DATE=$(find_date "$CURL_OUTPUT" dev_cel)
+GOOGLEAPIS_SHA=$(find_sha googleapis)
+PGV_GIT_SHA=$(find_sha protoc-gen-validate)
+PROMETHEUS_SHA=$(find_sha prometheus-metrics-model)
+XDS_SHA=$(find_sha xds)
+OPENTELEMETRY_SHA=$(find_sha opentelemetry-proto)
+# Envoy removed its direct CEL pin in envoyproxy/envoy#43265, so the API
+# lockfile now selects 0.24.0. Keep 0.25.1 to preserve our generated CEL API
+# while we clarify upstream whether api/ should restore that version.
+CEL_SHA="0.25.1"
 
 echo -n "# Update the versions here and run update-api.sh
 
 # envoy (source: SHA from https://github.com/envoyproxy/envoy)
 ENVOY_SHA=\"$ENVOY_VERSION\"
 
-# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/api/bazel/repository_locations.bzl)
-GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\"  # $GOOGLEAPIS_DATE
-PGV_VERSION=\"$PGV_GIT_SHA\"  # $PGV_GIT_DATE
-PROMETHEUS_SHA=\"$PROMETHEUS_SHA\"  # $PROMETHEUS_DATE
-OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\"  # $OPENTELEMETRY_DATE
-CEL_VERSION=\"$CEL_SHA\"  # $CEL_DATE
-XDS_SHA=\"$XDS_SHA\"  # $XDS_DATE
+# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/api/MODULE.bazel.lock)
+GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\"
+PGV_VERSION=\"$PGV_GIT_SHA\"
+PROMETHEUS_SHA=\"$PROMETHEUS_SHA\"
+OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\"
+CEL_VERSION=\"$CEL_SHA\"  # Pinned for API compatibility.
+XDS_SHA=\"$XDS_SHA\"
 "
 
 # replace version in EnvoyContainer.java