diff --git a/ci/build_container/build_recipes/luajit.sh b/ci/build_container/build_recipes/luajit.sh
index e05d6c8880f5..ad10e02e08a4 100644
--- a/ci/build_container/build_recipes/luajit.sh
+++ b/ci/build_container/build_recipes/luajit.sh
@@ -2,19 +2,17 @@
 
 set -e
 
-VERSION=2.0.5
-SHA256=8bb29d84f06eb23c7ea4aa4794dbb248ede9fcb23b6989cbef81dc79352afc97
+VERSION=2.1.0-beta3
+SHA256=409f7fe570d3c16558e594421c47bdd130238323c9d6fd6c83dedd2aaeb082a8
 
 curl https://github.com/LuaJIT/LuaJIT/archive/v"$VERSION".tar.gz -sLo LuaJIT-"$VERSION".tar.gz \
   && echo "$SHA256" LuaJIT-"$VERSION".tar.gz | sha256sum --check
 tar xf LuaJIT-"$VERSION".tar.gz
-cd LuaJIT-"$VERSION"
-
 
 # Fixup Makefile with things that cannot be set via env var.
-cat > ../luajit_make.diff << 'EOF'
+cat > luajit_make.diff << 'EOF'
 diff --git a/src/Makefile b/src/Makefile
-index f7f81a4..e698517 100644
+index f56465d..3f4f2fa 100644
 --- a/src/Makefile
 +++ b/src/Makefile
 @@ -27,7 +27,7 @@ NODOTABIVER= 51
@@ -26,7 +24,7 @@ index f7f81a4..e698517 100644
  #
  # Use this if you want to force a 32 bit build on a 64 bit multilib OS.
  #CC= $(DEFAULT_CC) -m32
-@@ -74,10 +74,10 @@ CCWARN= -Wall
+@@ -71,10 +71,10 @@ CCWARN= -Wall
  # as dynamic mode.
  #
  # Mixed mode creates a static + dynamic library and a statically linked luajit.
@@ -39,7 +37,7 @@ index f7f81a4..e698517 100644
  #
  # Dynamic mode creates a dynamic library and a dynamically linked luajit.
  # Note: this executable will only run when the library is installed!
-@@ -102,7 +102,7 @@ XCFLAGS=
+@@ -99,7 +99,7 @@ XCFLAGS=
  # enabled by default. Some other features that *might* break some existing
  # code (e.g. __pairs or os.execute() return values) can be enabled here.
  # Note: this does not provide full compatibility with Lua 5.2 at this time.
@@ -48,7 +46,7 @@ index f7f81a4..e698517 100644
  #
  # Disable the JIT compiler, i.e. turn LuaJIT into a pure interpreter.
  #XCFLAGS+= -DLUAJIT_DISABLE_JIT
-@@ -564,7 +564,7 @@ endif
+@@ -587,7 +587,7 @@ endif
 
  Q= @
  E= @echo
@@ -59,12 +57,14 @@ index f7f81a4..e698517 100644
  ##############################################################################
 EOF
 
+cd LuaJIT-"$VERSION"
+
 if [[ "${OS}" == "Windows_NT" ]]; then
   cd src
   ./msvcbuild.bat debug
 
-  mkdir -p "$THIRDPARTY_BUILD/include/luajit-2.0"
-  cp *.h* "$THIRDPARTY_BUILD/include/luajit-2.0"
+  mkdir -p "$THIRDPARTY_BUILD/include/luajit-2.1"
+  cp *.h* "$THIRDPARTY_BUILD/include/luajit-2.1"
   cp luajit.lib "$THIRDPARTY_BUILD/lib"
   cp *.pdb "$THIRDPARTY_BUILD/lib"
 else
diff --git a/ci/prebuilt/BUILD b/ci/prebuilt/BUILD
index 8997736ea30a..23e1f5c0f394 100644
--- a/ci/prebuilt/BUILD
+++ b/ci/prebuilt/BUILD
@@ -43,9 +43,9 @@ cc_library(
         ":windows_x86_64": ["thirdparty_build/lib/luajit.lib"],
         "//conditions:default": ["thirdparty_build/lib/libluajit-5.1.a"],
     }),
-    hdrs = glob(["thirdparty_build/include/luajit-2.0/*"]),
+    hdrs = glob(["thirdparty_build/include/luajit-2.1/*"]),
     includes = ["thirdparty_build/include"],
-    # TODO(mattklein123): We should strip luajit-2.0 here for consumers. However, if we do that
+    # TODO(mattklein123): We should strip luajit-2.1 here for consumers. However, if we do that
     # the headers get included using -I vs. -isystem which then causes old-style-cast warnings.
 )
 
diff --git a/source/exe/signal_action.cc b/source/exe/signal_action.cc
deleted file mode 100644
index bcd297e14144..000000000000
--- a/source/exe/signal_action.cc
+++ /dev/null
@@ -1,117 +0,0 @@
-#include "exe/signal_action.h"
-
-#include <signal.h>
-#include <sys/mman.h>
-
-#include "common/common/assert.h"
-
-namespace Envoy {
-constexpr int SignalAction::FATAL_SIGS[];
-
-void SignalAction::sigHandler(int sig, siginfo_t* info, void* context) {
-  void* error_pc = 0;
-
-  const ucontext_t* ucontext = reinterpret_cast<const ucontext_t*>(context);
-  if (ucontext != nullptr) {
-#ifdef REG_RIP
-    // x86_64
-    error_pc = reinterpret_cast<void*>(ucontext->uc_mcontext.gregs[REG_RIP]);
-#elif defined(__APPLE__) && defined(__x86_64__)
-    error_pc = reinterpret_cast<void*>(ucontext->uc_mcontext->__ss.__rip);
-#elif defined(__powerpc__)
-    error_pc = reinterpret_cast<void*>(ucontext->uc_mcontext.regs->nip);
-#else
-#warning "Please enable and test PC retrieval code for your arch in signal_action.cc"
-// x86 Classic: reinterpret_cast<void*>(ucontext->uc_mcontext.gregs[REG_EIP]);
-// ARM: reinterpret_cast<void*>(ucontext->uc_mcontext.arm_pc);
-#endif
-  }
-
-  BackwardsTrace tracer;
-  tracer.logFault(strsignal(sig), info->si_addr);
-  if (error_pc != 0) {
-    tracer.captureFrom(error_pc);
-  } else {
-    tracer.capture();
-  }
-  tracer.logTrace();
-
-  signal(sig, SIG_DFL);
-  raise(sig);
-}
-
-void SignalAction::installSigHandlers() {
-  stack_t stack;
-  stack.ss_sp = altstack_ + guard_size_; // Guard page at one end ...
-  stack.ss_size = altstack_size_;        // ... guard page at the other
-  stack.ss_flags = 0;
-
-  RELEASE_ASSERT(sigaltstack(&stack, &previous_altstack_) == 0, "");
-
-  int hidx = 0;
-  for (const auto& sig : FATAL_SIGS) {
-    struct sigaction saction;
-    std::memset(&saction, 0, sizeof(saction));
-    sigemptyset(&saction.sa_mask);
-    saction.sa_flags = (SA_SIGINFO | SA_ONSTACK | SA_RESETHAND | SA_NODEFER);
-    saction.sa_sigaction = sigHandler;
-    auto* handler = &previous_handlers_[hidx++];
-    RELEASE_ASSERT(sigaction(sig, &saction, handler) == 0, "");
-  }
-}
-
-void SignalAction::removeSigHandlers() {
-#if defined(__APPLE__)
-  // ss_flags contains SS_DISABLE, but Darwin still checks the size, contrary to the man page
-  if (previous_altstack_.ss_size < MINSIGSTKSZ) {
-    previous_altstack_.ss_size = MINSIGSTKSZ;
-  }
-#endif
-  RELEASE_ASSERT(sigaltstack(&previous_altstack_, nullptr) == 0, "");
-
-  int hidx = 0;
-  for (const auto& sig : FATAL_SIGS) {
-    auto* handler = &previous_handlers_[hidx++];
-    RELEASE_ASSERT(sigaction(sig, handler, nullptr) == 0, "");
-  }
-}
-
-#if defined(__APPLE__) && !defined(MAP_STACK)
-#define MAP_STACK (0)
-#endif
-
-void SignalAction::mapAndProtectStackMemory() {
-  // Per docs MAP_STACK doesn't actually do anything today but provides a
-  // library hint that might be used in the future.
-  altstack_ = static_cast<char*>(mmap(nullptr, mapSizeWithGuards(), PROT_READ | PROT_WRITE,
-                                      MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0));
-  RELEASE_ASSERT(altstack_, "");
-  RELEASE_ASSERT(mprotect(altstack_, guard_size_, PROT_NONE) == 0, "");
-  RELEASE_ASSERT(mprotect(altstack_ + guard_size_ + altstack_size_, guard_size_, PROT_NONE) == 0,
-                 "");
-}
-
-void SignalAction::unmapStackMemory() { munmap(altstack_, mapSizeWithGuards()); }
-
-void SignalAction::doGoodAccessForTest() {
-  volatile char* altaltstack = altstack_;
-  for (size_t i = 0; i < altstack_size_; ++i) {
-    *(altaltstack + guard_size_ + i) = 42;
-  }
-  for (size_t i = 0; i < altstack_size_; ++i) {
-    ASSERT(*(altaltstack + guard_size_ + i) == 42);
-  }
-}
-
-void SignalAction::tryEvilAccessForTest(bool end) {
-  volatile char* altaltstack = altstack_;
-  if (end) {
-    // One byte past the valid region
-    // http://oeis.org/A001969
-    *(altaltstack + guard_size_ + altstack_size_) = 43;
-  } else {
-    // One byte before the valid region
-    *(altaltstack + guard_size_ - 1) = 43;
-  }
-}
-} // namespace Envoy