diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
index 8f2547061b..ccdd828c24 100644
--- a/bazel/foreign_cc/BUILD
+++ b/bazel/foreign_cc/BUILD
@@ -211,6 +211,24 @@ envoy_cmake(
     deps = ["//bazel:boringssl"],
 )
 
+configure_make(
+    name = "luajit2",
+    configure_command = "build.py",
+    env = select({
+        # This shouldn't be needed! See
+        # https://github.com/envoyproxy/envoy/issues/6084
+        # TODO(htuch): Remove when #6084 is fixed
+        "//bazel:asan_build": {"ENVOY_CONFIG_ASAN": "1"},
+        "//bazel:msan_build": {"ENVOY_CONFIG_MSAN": "1"},
+        "//conditions:default": {},
+    }),
+    lib_source = "@com_github_luajit2_luajit2//:all",
+    out_include_dir = "include/luajit-2.1",
+    out_static_libs = ["libluajit-5.1.a"],
+    tags = ["skip_on_windows"],
+    targets = [],
+)
+
 envoy_cmake(
     name = "ares",
     cache_entries = {
diff --git a/bazel/foreign_cc/luajit2.patch b/bazel/foreign_cc/luajit2.patch
new file mode 100644
index 0000000000..e1263febc6
--- /dev/null
+++ b/bazel/foreign_cc/luajit2.patch
@@ -0,0 +1,99 @@
+diff --git a/build.py b/build.py
+new file mode 100644
+index 00000000..dab3606c
+--- /dev/null
++++ b/build.py
+@@ -0,0 +1,49 @@
++#!/usr/bin/env python3
++
++import argparse
++import os
++import shutil
++import subprocess
++
++def main():
++    parser = argparse.ArgumentParser()
++    parser.add_argument("--prefix")
++    args = parser.parse_args()
++    src_dir = os.path.dirname(os.path.realpath(__file__))
++    shutil.copytree(src_dir, os.path.basename(src_dir))
++    os.chdir(os.path.basename(src_dir))
++
++    os.environ["MACOSX_DEPLOYMENT_TARGET"] = "10.6"
++    os.environ["DEFAULT_CC"] = os.environ.get("CC", "")
++    os.environ["TARGET_CFLAGS"] = os.environ.get("CFLAGS", "") + " -fno-function-sections -fno-data-sections"
++    os.environ["TARGET_LDFLAGS"] = os.environ.get("CFLAGS", "") + " -fno-function-sections -fno-data-sections"
++    os.environ["CFLAGS"] = ""
++    # LuaJIT compile process build a tool `buildvm` and use it, building `buildvm` with ASAN
++    # will cause LSAN detect its leak and fail the build, set exitcode to 0 to make LSAN doesn't
++    # fail on it.
++    os.environ["LSAN_OPTIONS"] = "exitcode=0"
++
++    if "ENVOY_MSAN" in os.environ:
++      os.environ["HOST_CFLAGS"] = "-fno-sanitize=memory"
++      os.environ["HOST_LDFLAGS"] = "-fno-sanitize=memory"
++
++    arch = subprocess.check_output(["uname","-m"]).decode("utf-8").strip()
++    compiler = os.environ.get("CC", "")
++    if "clang" in compiler and arch in ["s390x","ppc64le"]:
++        extra_clang_cflags = " -fgnuc-version=10 -fno-integrated-as -Wno-implicit-function-declaration -D_Float32=float -D_Float64=double -D_Float128=double -D_Float32x=double -D_Float64x=double"
++        os.environ["TARGET_CFLAGS"] += extra_clang_cflags
++        os.environ["TARGET_LDFLAGS"] += " -fgnuc-version=10"
++        os.environ["HOST_CFLAGS"] = os.environ.get("HOST_CFLAGS", "") + extra_clang_cflags
++        os.environ["HOST_LDFLAGS"] = os.environ.get("HOST_LDFLAGS", "") + " -fgnuc-version=10"
++
++    # Remove LuaJIT from ASAN for now.
++    # TODO(htuch): Remove this when https://github.com/envoyproxy/envoy/issues/6084 is resolved.
++    if "ENVOY_CONFIG_ASAN" in os.environ or "ENVOY_CONFIG_MSAN" in os.environ:
++      os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blocklist.txt" % os.environ["PWD"]
++      with open("clang-asan-blocklist.txt", "w") as f:
++        f.write("fun:*\n")
++
++    os.system('make -j{} V=1 PREFIX="{}" install'.format(os.cpu_count(), args.prefix))
++
++main()
++
+diff --git a/src/Makefile b/src/Makefile
+index acbe0ca7..313a7e44 100644
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -27,7 +27,7 @@ NODOTABIVER= 51
+ DEFAULT_CC = gcc
+ #
+ # LuaJIT builds as a native 32 or 64 bit binary by default.
+-CC= $(DEFAULT_CC)
++CC ?= $(DEFAULT_CC)
+ #
+ # Use this if you want to force a 32 bit build on a 64 bit multilib OS.
+ #CC= $(DEFAULT_CC) -m32
+@@ -71,10 +71,10 @@ CCWARN= -Wall
+ # as dynamic mode.
+ #
+ # Mixed mode creates a static + dynamic library and a statically linked luajit.
+-BUILDMODE= mixed
++#BUILDMODE= mixed
+ #
+ # Static mode creates a static library and a statically linked luajit.
+-#BUILDMODE= static
++BUILDMODE= static
+ #
+ # Dynamic mode creates a dynamic library and a dynamically linked luajit.
+ # Note: this executable will only run when the library is installed!
+@@ -99,7 +99,7 @@ XCFLAGS=
+ # enabled by default. Some other features that *might* break some existing
+ # code (e.g. __pairs or os.execute() return values) can be enabled here.
+ # Note: this does not provide full compatibility with Lua 5.2 at this time.
+-#XCFLAGS+= -DLUAJIT_ENABLE_LUA52COMPAT
++XCFLAGS+= -DLUAJIT_ENABLE_LUA52COMPAT
+ #
+ # Disable the JIT compiler, i.e. turn LuaJIT into a pure interpreter.
+ #XCFLAGS+= -DLUAJIT_DISABLE_JIT
+@@ -617,7 +617,7 @@ endif
+
+ Q= @
+ E= @echo
+-#Q=
++Q=
+ #E= @:
+
+ ##############################################################################
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 01616adb87..7be7e965f2 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -287,6 +287,7 @@ def envoy_dependencies(skip_targets = []):
     _com_github_jbeder_yaml_cpp()
     _com_github_libevent_libevent()
     _com_github_luajit_luajit()
+    _com_github_luajit2_luajit2()
     _com_github_nghttp2_nghttp2()
     _com_github_skyapm_cpp2sky()
     _com_github_nodejs_http_parser()
@@ -1223,6 +1224,20 @@ def _com_github_luajit_luajit():
         actual = "@envoy//bazel/foreign_cc:luajit",
     )
 
+def _com_github_luajit2_luajit2():
+    external_http_archive(
+        name = "com_github_luajit2_luajit2",
+        build_file_content = BUILD_ALL_CONTENT,
+        patches = ["@envoy//bazel/foreign_cc:luajit2.patch"],
+        patch_args = ["-p1"],
+        patch_cmds = ["chmod u+x build.py"],
+    )
+
+    native.bind(
+        name = "luajit2",
+        actual = "@envoy//bazel/foreign_cc:luajit2",
+    )
+
 def _com_github_google_tcmalloc():
     external_http_archive(
         name = "com_github_google_tcmalloc",
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index f3e69cdec4..9681c9cf12 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -452,6 +452,19 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         license = "MIT",
         license_url = "https://github.com/LuaJIT/LuaJIT/blob/{version}/COPYRIGHT",
     ),
+    com_github_luajit2_luajit2 = dict(
+        project_name = "Luajit2",
+        project_desc = "Openresty/luajit2 - OpenResty's maintained branch of LuaJIT",
+        project_url = "https://github.com/openresty/luajit2",
+        version = "1085a4d562b449e7be9e4508b52a19651bdf04a6",
+        sha256 = "2f6931ecac967e8fafffe934a8445593deff9f4c6ece1684fea1277edd0931ee",
+        strip_prefix = "luajit2-{version}",
+        urls = ["https://github.com/openresty/luajit2/archive/{version}.tar.gz"],
+        use_category = ["dataplane_ext"],
+        extensions = ["envoy.filters.http.lua"],
+        release_date = "2021-11-17",
+        cpe = "cpe:2.3:a:luajit2:luajit2:*",
+    ),
     com_github_nghttp2_nghttp2 = dict(
         project_name = "Nghttp2",
         project_desc = "Implementation of HTTP/2 and its header compression algorithm HPACK in C",
diff --git a/openssl/bazelrc b/openssl/bazelrc
index 5c9ca227f2..cf80a3452b 100644
--- a/openssl/bazelrc
+++ b/openssl/bazelrc
@@ -14,3 +14,6 @@ common --//bazel:http3=False
 common --define=boringssl=fips
 build --build_tag_filters=-nofips
 test --test_tag_filters=-nofips
+
+# Arch-specific build flags, triggered with --config=$ARCH in bazel build command
+build:s390x --//source/extensions/filters/common/lua:luajit2=1 --copt="-Wno-deprecated-declarations" --linkopt=-fuse-ld=gold
diff --git a/source/extensions/filters/common/lua/BUILD b/source/extensions/filters/common/lua/BUILD
index 12d7d0554a..3a7c063147 100644
--- a/source/extensions/filters/common/lua/BUILD
+++ b/source/extensions/filters/common/lua/BUILD
@@ -4,17 +4,29 @@ load(
     "envoy_extension_package",
 )
 
+load("//bazel:envoy_internal.bzl", "envoy_external_dep_path")
+load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
+
 licenses(["notice"])  # Apache 2
 
 envoy_extension_package()
 
+bool_flag(
+    name = "luajit2",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "with_luajit2",
+    flag_values = {
+        ":luajit2": "True",
+    },
+)
+
 envoy_cc_library(
     name = "lua_lib",
     srcs = ["lua.cc"],
     hdrs = ["lua.h"],
-    external_deps = [
-        "luajit",
-    ],
     deps = [
         "//envoy/thread_local:thread_local_interface",
         "//source/common/common:assert_lib",
@@ -22,7 +34,10 @@ envoy_cc_library(
         "//source/common/common:lock_guard_lib",
         "//source/common/common:thread_lib",
         "//source/common/protobuf",
-    ],
+    ] + select({
+        ":with_luajit2": [envoy_external_dep_path("luajit2")],
+        "//conditions:default": [envoy_external_dep_path("luajit")],
+    }),
 )
 
 envoy_cc_library(