diff --git a/.bazelrc b/.bazelrc
index 1d8a2fdd2..755ddc225 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,5 +1,9 @@
 # Remove once Bazel 8 becomes the minimum supported version.
-common --noenable_workspace --incompatible_use_plus_in_repo_names
+common --noenable_workspace --incompatible_use_plus_in_repo_names --incompatible_autoload_externally=
+
+# Uncomment to run tests under `WORKSPACE`. Remove once Bazel 9 becomes the
+# minimum supported version.
+#common --enable_workspace --noenable_bzlmod
 
 # Uncomment for WORKSPACE builds for Bazel [8.0.0, 8.3.0) per:
 # https://github.com/bazelbuild/rules_java/releases/tag/8.12.0
diff --git a/BUILD b/BUILD
index e69de29bb..ebfeb3d32 100644
--- a/BUILD
+++ b/BUILD
@@ -0,0 +1,4 @@
+# For //tools:lint_check, which requires a `workspace` attribute. However, this
+# can be any file, and `WORKSPACE` is going away one day. See:
+# https://github.com/bazelbuild/buildtools/blob/v8.2.1/buildifier/runner.bash.template
+exports_files(["MODULE.bazel"])
diff --git a/MODULE.bazel b/MODULE.bazel
index ae3495f18..c32f597f1 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -302,4 +302,4 @@ use_repo(
 )
 
 bazel_dep(name = "rules_python", version = "1.4.1", dev_dependency = True)
-bazel_dep(name = "rules_shell", version = "0.4.1", dev_dependency = True)
+bazel_dep(name = "rules_shell", version = "0.5.0", dev_dependency = True)
diff --git a/WORKSPACE b/WORKSPACE
index 6e593af3d..ea6abe0cb 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -151,9 +151,9 @@ register_toolchains("//test/toolchains:java21_toolchain_definition")
 
 http_archive(
     name = "rules_shell",
-    sha256 = "bc61ef94facc78e20a645726f64756e5e285a045037c7a61f65af2941f4c25e1",
-    strip_prefix = "rules_shell-0.4.1",
-    url = "https://github.com/bazelbuild/rules_shell/releases/download/v0.4.1/rules_shell-v0.4.1.tar.gz",
+    sha256 = "b15cc2e698a3c553d773ff4af35eb4b3ce2983c319163707dddd9e70faaa062d",
+    strip_prefix = "rules_shell-0.5.0",
+    url = "https://github.com/bazelbuild/rules_shell/releases/download/v0.5.0/rules_shell-v0.5.0.tar.gz",
 )
 
 load(
diff --git a/scala/latest_deps.bzl b/scala/latest_deps.bzl
index a857691fc..ab8bb5518 100644
--- a/scala/latest_deps.bzl
+++ b/scala/latest_deps.bzl
@@ -51,3 +51,21 @@ def rules_scala_dependencies():
         strip_prefix = "rules_proto-7.1.0",
         url = "https://github.com/bazelbuild/rules_proto/releases/download/7.1.0/rules_proto-7.1.0.tar.gz",
     )
+
+    # Resolves the following error when building under `WORKSPACE` with Bazel 8.2.1,
+    # `protobuf` v31.1, and `rules_java` 8.12.0:
+    # https://github.com/protocolbuffers/protobuf/pull/19129#issuecomment-2968934424
+    rules_jvm_external_tag = "6.7"
+    rules_jvm_external_sha = (
+        "a1e351607f04fed296ba33c4977d3fe2a615ed50df7896676b67aac993c53c18"
+    )
+    maybe(
+        http_archive,
+        name = "rules_jvm_external",
+        sha256 = rules_jvm_external_sha,
+        strip_prefix = "rules_jvm_external-%s" % rules_jvm_external_tag,
+        url = "https://github.com/bazel-contrib/rules_jvm_external/releases/download/%s/rules_jvm_external-%s.tar.gz" % (
+            rules_jvm_external_tag,
+            rules_jvm_external_tag,
+        ),
+    )
diff --git a/scala/private/extensions/dev_deps.bzl b/scala/private/extensions/dev_deps.bzl
index b539c5283..866a5666f 100644
--- a/scala/private/extensions/dev_deps.bzl
+++ b/scala/private/extensions/dev_deps.bzl
@@ -10,7 +10,8 @@ load(
 )
 load("//third_party/repositories:repositories.bzl", "repositories")
 
-_BUILD_TOOLS_RELEASE = "5.1.0"
+_BUILD_TOOLS_RELEASE = "8.2.1"
+_BUILD_TOOLS_INTEGRITY = "sha256-UxGTl7vOHNfkxZDhF9zaNDwghhmd5ikyEGyAczUmwmE="
 
 _settings_defaults = {
     "maven_servers": default_maven_server_urls(),
@@ -41,12 +42,16 @@ def dev_deps_repositories(
         maven_servers: servers to use when resolving Maven artifacts
         fetch_sources: retrieve Maven artifact sources when True
     """
+
+    # gazelle is still getting `buildtools` from its `go.mod` file, which breaks
+    # `bazel run //tools:lint_check` when we don't import it like this. See:
+    # - https://github.com/bazel-contrib/bazel-gazelle/blob/v0.43.0/MODULE.bazel#L32-L44
     http_archive(
         name = "com_github_bazelbuild_buildtools",
-        sha256 = "e3bb0dc8b0274ea1aca75f1f8c0c835adbe589708ea89bf698069d0790701ea3",
+        integrity = _BUILD_TOOLS_INTEGRITY,
         strip_prefix = "buildtools-%s" % _BUILD_TOOLS_RELEASE,
         url = (
-            "https://github.com/bazelbuild/buildtools/archive/%s.tar.gz" %
+            "https://github.com/bazelbuild/buildtools/archive/v%s.tar.gz" %
             _BUILD_TOOLS_RELEASE
         ),
     )
diff --git a/scala/scala_maven_import_external.bzl b/scala/scala_maven_import_external.bzl
index 620b031db..557968bf8 100644
--- a/scala/scala_maven_import_external.bzl
+++ b/scala/scala_maven_import_external.bzl
@@ -40,6 +40,9 @@ load("@bazel_tools//tools/build_defs/repo:utils.bzl", "read_netrc", "read_user_n
 _SCALA_IMPORT_RULE_LOAD = (
     "load(\"%s\", \"scala_import\")" % Label("//scala:scala_import.bzl")
 )
+_JAVA_IMPORT_RULE_LOAD = (
+    "load(\"@rules_java//java:java_import.bzl\", \"java_import\")"
+)
 
 # https://github.com/bazelbuild/bazel/issues/13709#issuecomment-1336699672
 def _get_auth(ctx, urls):
@@ -97,6 +100,7 @@ def _jvm_import_external_impl(repository_ctx):
         lines.append("package(default_visibility = %s)" %
                      (repository_ctx.attr.default_visibility))
         lines.append("")
+
     lines.append("licenses(%s)" % repr(repository_ctx.attr.licenses))
     lines.append("")
     lines.extend(
@@ -229,6 +233,7 @@ def _serialize_given_rule_import(
     lines.append("")
     return lines
 
+# buildifier: disable=attr-licenses
 _jvm_import_external = repository_rule(
     implementation = _jvm_import_external_impl,
     attrs = {
@@ -237,7 +242,7 @@ _jvm_import_external = repository_rule(
         "jar_urls": attr.string_list(mandatory = True, allow_empty = False),
         "jar_sha256": attr.string(doc = "'jar_sha256' is deprecated. Please use 'artifact_sha256'"),
         "artifact_sha256": attr.string(),
-        "rule_load": attr.string(),
+        "rule_load": attr.string(default = _JAVA_IMPORT_RULE_LOAD),
         "additional_rule_attrs": attr.string_dict(),
         "srcjar_urls": attr.string_list(),
         "srcjar_sha256": attr.string(),
diff --git a/tools/BUILD b/tools/BUILD
index 84264eb76..03169e022 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -1,4 +1,8 @@
-load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier")
+load(
+    "@com_github_bazelbuild_buildtools//buildifier:def.bzl",
+    "buildifier",
+    "buildifier_test",
+)
 
 WARNINGS_CONFIG = [
     "-module-docstring",
@@ -16,7 +20,7 @@ WARNINGS_CONFIG = [
     "-unused-variable",
 ]
 
-buildifier(
+buildifier_test(
     name = "lint_check",
     exclude_patterns = [
         "./.ijwb/*",
@@ -24,6 +28,8 @@ buildifier(
     lint_mode = "warn",
     lint_warnings = WARNINGS_CONFIG,
     mode = "check",
+    no_sandbox = True,
+    workspace = "//:MODULE.bazel",
 )
 
 buildifier(