diff --git a/.bazelversion b/.bazelversion
deleted file mode 100644
index 468c41f93..000000000
--- a/.bazelversion
+++ /dev/null
@@ -1 +0,0 @@
-7.2.1
\ No newline at end of file
diff --git a/BUILD b/BUILD
index 4c9dcbc28..5ce54ec96 100644
--- a/BUILD
+++ b/BUILD
@@ -1,5 +1,6 @@
 load("@bazel_gazelle//:def.bzl", "gazelle")
 load("@rules_license//rules:license.bzl", "license")
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 package(
     default_applicable_licenses = [":license"],
diff --git a/MODULE.bazel b/MODULE.bazel
index 4b31327a0..8c313a193 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -7,6 +7,7 @@ module(
 bazel_dep(name = "platforms", version = "0.0.5")
 bazel_dep(name = "rules_license", version = "0.0.4")
 bazel_dep(name = "rules_java", version = "7.11.1")
+bazel_dep(name = "rules_shell", version = "0.1.2")
 
 bazel_dep(name = "stardoc", version = "0.6.2", dev_dependency = True)
 # Use a later commit until a version with table of contents, stamping, and
@@ -84,7 +85,7 @@ maven.install(
         "org.robolectric:robolectric:4.10.3",
         "com.google.flogger:flogger:0.8",
         "com.google.guava:guava:32.1.2-jre",
-        "com.google.protobuf:protobuf-java-util:3.9.2",
+        "com.google.protobuf:protobuf-java-util:4.27.2",
         "com.google.truth:truth:1.1.5",
         "info.picocli:picocli:4.7.4",
         "jakarta.inject:jakarta.inject-api:2.0.1",
diff --git a/defs.bzl b/defs.bzl
index 82b6c1506..c255cc975 100644
--- a/defs.bzl
+++ b/defs.bzl
@@ -29,6 +29,7 @@ load("@rules_jvm_external//:defs.bzl", "maven_install")
 load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies")
 load("@rules_proto//proto:toolchains.bzl", "rules_proto_toolchains")
 load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
 
 def rules_android_workspace():
     """ Sets up workspace dependencies for rules_android."""
@@ -57,7 +58,7 @@ def rules_android_workspace():
             "org.robolectric:robolectric:4.10.3",
             "com.google.flogger:flogger:0.8",
             "com.google.guava:guava:32.1.2-jre",
-            "com.google.protobuf:protobuf-java-util:3.9.2",
+            "com.google.protobuf:protobuf-java-util:4.27.2",
             "com.google.truth:truth:1.1.5",
             "info.picocli:picocli:4.7.4",
             "jakarta.inject:jakarta.inject-api:2.0.1",
@@ -106,6 +107,24 @@ def rules_android_workspace():
         # NOTE: above lockfile currently disabled due to https://github.com/bazelbuild/rules_jvm_external/issues/1134.
     )
 
+    maven_install(
+        name = "maven",
+        artifacts = [ # bazel worker api
+            "com.google.code.gson:gson:2.10.1", # bazel worker api
+            "com.google.errorprone:error_prone_annotations:2.23.0", # bazel worker api
+            "com.google.guava:guava:33.0.0-jre", # bazel worker api
+            "com.google.protobuf:protobuf-java:4.27.2", # bazel worker api
+            "com.google.protobuf:protobuf-java-util:4.27.2", # bazel worker api
+            "junit:junit:4.13.2", # bazel worker api
+            "org.mockito:mockito-core:5.4.0", # bazel worker api
+            "com.google.truth:truth:1.4.0", # bazel worker api
+        ], # bazel worker api
+        aar_import_bzl_label = "@rules_android//rules:rules.bzl",
+        repositories = [
+            "https://repo1.maven.org/maven2",
+            "https://maven.google.com",
+        ],
+    )
     go_rules_dependencies()
 
     _GO_TOOLCHAIN_VERSION = "1.22.4"
@@ -161,3 +180,6 @@ def rules_android_workspace():
         # We recommend using the same version your team is already standardized on.
         python_version = "3.11",
     )
+
+    rules_shell_dependencies()
+    rules_shell_toolchains()
diff --git a/kokoro/presubmit/presubmit_main.sh b/kokoro/presubmit/presubmit_main.sh
index b7be2b5ac..33c553a3c 100644
--- a/kokoro/presubmit/presubmit_main.sh
+++ b/kokoro/presubmit/presubmit_main.sh
@@ -113,7 +113,7 @@ function main() {
   # Maven artifact consistency test
   # The sed commands in the `<()` blocks extract the artifacts list from maven_install.
   # `diff -w` compares the two files without whitespaces.
-  diff -w <(sed -n '/artifacts =/{:start /]/!{N;b start};/.*/p}' defs.bzl) <(sed -n '/artifacts =/{:start /]/!{N;b start};/.*/p}' MODULE.bazel)
+  diff -w <(sed -n '/artifacts =/{:start /]/!{N;b start};/.*/p}' defs.bzl | grep -v "bazel_worker_api") <(sed -n '/artifacts =/{:start /]/!{N;b start};/.*/p}' MODULE.bazel)
 
   # Sync with bzlmod disabled to sniff out WORKSPACE issues
   "$bazel" sync --noenable_bzlmod > /dev/null
diff --git a/prereqs.bzl b/prereqs.bzl
index 6a5e49ae7..ecb1286a0 100644
--- a/prereqs.bzl
+++ b/prereqs.bzl
@@ -42,9 +42,9 @@ def rules_android_prereqs(dev_mode = False):
     maybe(
         http_archive,
         name = "com_google_protobuf",
-        sha256 = "87407cd28e7a9c95d9f61a098a53cf031109d451a7763e7dd1253abf8b4df422",
-        strip_prefix = "protobuf-3.19.1",
-        urls = ["https://github.com/protocolbuffers/protobuf/archive/v3.19.1.tar.gz"],
+        sha256 = "b2340aa47faf7ef10a0328190319d3f3bee1b24f426d4ce8f4253b6f27ce16db",
+        strip_prefix = "protobuf-28.2",
+        urls = ["https://github.com/protocolbuffers/protobuf/archive/v28.2.tar.gz"],
     )
 
     maybe(
@@ -130,9 +130,9 @@ def rules_android_prereqs(dev_mode = False):
     maybe(
         http_archive,
         name = "rules_proto",
-        sha256 = "303e86e722a520f6f326a50b41cfc16b98fe6d1955ce46642a5b7a67c11c0f5d",
-        strip_prefix = "rules_proto-6.0.0",
-        url = "https://github.com/bazelbuild/rules_proto/releases/download/6.0.0/rules_proto-6.0.0.tar.gz",
+        sha256 = "6fb6767d1bef535310547e03247f7518b03487740c11b6c6adb7952033fe1295",
+        strip_prefix = "rules_proto-6.0.2",
+        url = "https://github.com/bazelbuild/rules_proto/releases/download/6.0.2/rules_proto-6.0.2.tar.gz",
     )
 
     maybe(
@@ -150,9 +150,6 @@ def rules_android_prereqs(dev_mode = False):
         http_archive,
         name = "bazel_worker_api",
         strip_prefix = "bazel-worker-api-0.0.1/proto",
-        patch_cmds = [
-            "find . -name 'BUILD.bazel' -exec sed -i 's/maven/rules_android_maven/g' {} \\;",
-        ],
         urls = [
             "https://github.com/bazelbuild/bazel-worker-api/releases/download/v0.0.1/bazel-worker-api-v0.0.1.tar.gz",
         ],
@@ -163,15 +160,20 @@ def rules_android_prereqs(dev_mode = False):
         http_archive,
         name = "bazel_worker_java",
         strip_prefix = "bazel-worker-api-0.0.1/java",
-        patch_cmds = [
-            "find . -name 'BUILD.bazel' -exec sed -i 's/maven/rules_android_maven/g' {} \\;",
-        ],
         urls = [
             "https://github.com/bazelbuild/bazel-worker-api/releases/download/v0.0.1/bazel-worker-api-v0.0.1.tar.gz",
         ],
         sha256 = "b341e3fba0a3dd0ab7bfdc7e256fad711a1f9e9255563a74c305676046b5a184",
     )
 
+    maybe(
+        http_archive,
+        name = "rules_shell",
+        sha256 = "a86bcdcfb7a14267fa81bd18e199a53315b864a89378a7eecd3db739bfa436e2",
+        strip_prefix = "rules_shell-0.1.2",
+        url = "https://github.com/bazelbuild/rules_shell/releases/download/v0.1.2/rules_shell-v0.1.2.tar.gz",
+    )
+
     _apksig_archive()
 
     if dev_mode:
diff --git a/rules/android_sdk_repository/helper.bzl b/rules/android_sdk_repository/helper.bzl
index 04ce5eac4..f199701a9 100644
--- a/rules/android_sdk_repository/helper.bzl
+++ b/rules/android_sdk_repository/helper.bzl
@@ -16,6 +16,7 @@
 load("@local_config_platform//:constraints.bzl", "HOST_CONSTRAINTS")
 load("@rules_android//rules:rules.bzl", "android_sdk")
 load("@rules_java//java:defs.bzl", "java_binary", "java_import")
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 def _bool_flag_impl(_unused_ctx):
     pass
@@ -315,7 +316,7 @@ def create_android_sdk_rules(
             ]),
         )
 
-        native.sh_binary(
+        sh_binary(
             name = tool + "_binary",
             srcs = [tool + "_runner.sh"],
             data = [
@@ -341,7 +342,7 @@ def create_android_sdk_rules(
         }),
     )
 
-    native.sh_binary(
+    sh_binary(
         name = "bash_fail",
         srcs = [":generate_fail_sh"],
     )
@@ -353,7 +354,7 @@ def create_android_sdk_rules(
         executable = 1,
     )
 
-    native.sh_binary(
+    sh_binary(
         name = "windows_fail.cmd",
         srcs = [":generate_fail_cmd"],
     )
@@ -385,7 +386,7 @@ def create_android_sdk_rules(
         ]),
     )
 
-    native.sh_binary(
+    sh_binary(
         name = "main_dex_list_creator",
         srcs = ["main_dex_list_creator.sh"],
         data = [":main_dex_list_creator_java"],
@@ -563,7 +564,7 @@ def create_dummy_sdk_toolchain():
         executable = 1,
     )
 
-    native.sh_binary(name = "empty-binary", srcs = [":genrule"])
+    sh_binary(name = "empty-binary", srcs = [":genrule"])
 
     android_sdk(
         name = "sdk-dummy",
diff --git a/src/tools/java/com/google/devtools/build/android/BUILD b/src/tools/java/com/google/devtools/build/android/BUILD
index becec1063..6692f517d 100644
--- a/src/tools/java/com/google/devtools/build/android/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/BUILD
@@ -1,6 +1,7 @@
 # Actions for Android rules.
 
 load("@rules_java//java:defs.bzl", "java_binary", "java_import", "java_library")
+load("//tools/android:defs.bzl", "run_singlejar")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -24,11 +25,13 @@ java_binary(
     runtime_deps = [":android_builder_lib"],
 )
 
-genrule(
+run_singlejar(
     name = "zip_jar_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["zip.jar"],
-    cmd = "unzip -q $< 'com/google/devtools/build/zip/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "zip.jar",
+    include_prefixes = [
+        "com/google/devtools/build/zip/",
+    ],
 )
 
 java_import(
@@ -36,11 +39,13 @@ java_import(
     jars = [":zip_jar_gen"],
 )
 
-genrule(
+run_singlejar(
     name = "singlejar_jar_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["singlejar.jar"],
-    cmd = "unzip -q $< 'com/google/devtools/build/singlejar/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "singlejar.jar",
+    include_prefixes = [
+        "com/google/devtools/build/singlejar/",
+    ],
 )
 
 java_import(
@@ -48,11 +53,13 @@ java_import(
     jars = [":singlejar_jar_gen"],
 )
 
-genrule(
+run_singlejar(
     name = "databinding_exec_jar_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["databinding_exec.jar"],
-    cmd = "unzip -q $< 'android/databinding/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "databinding_exec.jar",
+    include_prefixes = [
+        "android/databinding/",
+    ],
 )
 
 java_import(
@@ -60,11 +67,13 @@ java_import(
     jars = [":databinding_exec_jar_gen"],
 )
 
-genrule(
+run_singlejar(
     name = "kotlin_jar_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["kotlin.jar"],
-    cmd = "unzip -q $< 'kotlin/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "kotlin.jar",
+    include_prefixes = [
+        "kotlin/",
+    ],
 )
 
 java_import(
@@ -141,11 +150,14 @@ java_library(
     ],
 )
 
-genrule(
+run_singlejar(
     name = "android_common_jar_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["android_common_exec.jar"],
-    cmd = "unzip -q $< 'com/google/wireless*.class' 'com/android/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "android_common_exec.jar",
+    include_prefixes = [
+        "com/google/wireless/",
+        "com/android/",
+    ],
 )
 
 java_import(
diff --git a/src/tools/java/com/google/devtools/build/android/desugar/BUILD b/src/tools/java/com/google/devtools/build/android/desugar/BUILD
index ad3eb65f0..7217d93bb 100644
--- a/src/tools/java/com/google/devtools/build/android/desugar/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/desugar/BUILD
@@ -1,6 +1,8 @@
 # Description:
 #   Tool for desugaring Java constructs not supported by Android tools or devices.
 
+load("@rules_java//java:defs.bzl", "java_library")
+
 java_library(
     name = "desugar",
     tags = ["manual"],
diff --git a/src/tools/java/com/google/devtools/build/android/dexer/BUILD b/src/tools/java/com/google/devtools/build/android/dexer/BUILD
index 5f28d9ede..e717e1bfa 100644
--- a/src/tools/java/com/google/devtools/build/android/dexer/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/dexer/BUILD
@@ -1,7 +1,8 @@
 # Description:
 #   Collection of dex utilities used in the bazel android actions.
 
-load("@rules_java//java:defs.bzl", "java_import", "java_library")
+load("@rules_java//java:defs.bzl", "java_binary", "java_import", "java_library")
+load("//tools/android:defs.bzl", "run_singlejar")
 
 filegroup(
     name = "srcs",
@@ -12,11 +13,13 @@ filegroup(
     ],
 )
 
-genrule(
+run_singlejar(
     name = "android_dex_from_android_tools_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["android_dex_from_android_tools.jar"],
-    cmd = "unzip -q $< 'com/android/dex/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "android_dex_from_android_tools.jar",
+    include_prefixes = [
+        "com/android/dex/",
+    ],
 )
 
 java_import(
@@ -82,8 +85,6 @@ java_library(
     runtime_deps = [
         "@bazel_tools//src/main/protobuf:worker_protocol_java_proto",
         "//src/tools/java/com/google/devtools/build/android:android_builder_lib",
-        #"//third_party/android_dex",  # For DexFileSplitter so that it doesn't rely on dx.
-        "@androidsdk//:dx_jar_import",
         "@rules_android_maven//:com_google_auto_value_auto_value",
         "@rules_android_maven//:com_google_code_findbugs_jsr305",
         "@rules_android_maven//:com_google_guava_guava",
diff --git a/src/tools/java/com/google/devtools/build/android/idlclass/BUILD b/src/tools/java/com/google/devtools/build/android/idlclass/BUILD
index 0ef1cc394..85cf3e157 100644
--- a/src/tools/java/com/google/devtools/build/android/idlclass/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/idlclass/BUILD
@@ -1,4 +1,5 @@
 load("@rules_java//java:defs.bzl", "java_binary", "java_import", "java_library")
+load("//tools/android:defs.bzl", "run_singlejar")
 
 package(
     default_applicable_licenses = ["//:license"],
@@ -13,11 +14,13 @@ java_binary(
 )
 
 # NOTE: jarhelper actually exists in @bazel_tools, but its visibility is set too restrictively.
-genrule(
+run_singlejar(
     name = "jarhelper_jar_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["jarhelper.jar"],
-    cmd = "unzip -q $< 'com/google/devtools/build/buildjar/jarhelper/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "jarhelper.jar",
+    include_prefixes = [
+        "com/google/devtools/build/buildjar/jarhelper/",
+    ],
 )
 
 java_import(
diff --git a/src/tools/java/com/google/devtools/build/android/junctions/BUILD b/src/tools/java/com/google/devtools/build/android/junctions/BUILD
index fb1926408..68f159ce8 100644
--- a/src/tools/java/com/google/devtools/build/android/junctions/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/junctions/BUILD
@@ -1,4 +1,5 @@
-load("@rules_java//java:defs.bzl", "java_library")
+load("@rules_java//java:defs.bzl", "java_import", "java_library")
+load("//tools/android:defs.bzl", "run_singlejar")
 
 package(default_visibility = ["//visibility:private"])
 
@@ -28,11 +29,13 @@ filegroup(
     visibility = [":android-prod"],
 )
 
-genrule(
+run_singlejar(
     name = "windows_file_jar_gen",
     srcs = ["@android_tools//:all_android_tools_deploy.jar"],
-    outs = ["windows_file.jar"],
-    cmd = "unzip -q $< 'com/google/devtools/build/lib/windows/*.class' && zip $@ $$(find . -name \"*.class\")",
+    out = "windows_file.jar",
+    include_prefixes = [
+        "com/google/devtools/build/lib/windows/",
+    ],
 )
 
 java_import(
diff --git a/src/tools/java/com/google/devtools/build/android/r8/BUILD b/src/tools/java/com/google/devtools/build/android/r8/BUILD
index ffa477e88..a3a4b4e4c 100644
--- a/src/tools/java/com/google/devtools/build/android/r8/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/r8/BUILD
@@ -1,7 +1,7 @@
 # Description:
 #   Collection of dex utilities used in the bazel android actions.
 
-load("@rules_java//java:defs.bzl", "java_library")
+load("@rules_java//java:defs.bzl", "java_binary", "java_library")
 
 filegroup(
     name = "srcs",
diff --git a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/info/BUILD b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/info/BUILD
index 4f8e3367f..91d232583 100644
--- a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/info/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/info/BUILD
@@ -1,4 +1,5 @@
 # Utilities for extracting information from SDK archives and Bundle metadata.
+load("@rules_java//java:defs.bzl", "java_library")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/mixin/BUILD b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/mixin/BUILD
index cade12f07..250a95b84 100644
--- a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/mixin/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/mixin/BUILD
@@ -1,4 +1,5 @@
 # Package for mixins with shared logic between commands.
+load("@rules_java//java:defs.bzl", "java_library")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD
index 7f09d0ea8..6cad2c23b 100644
--- a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD
@@ -1,4 +1,5 @@
 # Command to generate the RuntimeEnabledSdkConfig file for app bundles.
+load("@rules_java//java:defs.bzl", "java_library")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD
index 70c6b5f26..d087b2cac 100644
--- a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD
@@ -1,4 +1,5 @@
 # Command for generating an SDK dependencies Android manifest.
+load("@rules_java//java:defs.bzl", "java_library")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD
index df55f48b2..2241b5af4 100644
--- a/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD
+++ b/src/tools/java/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD
@@ -1,4 +1,5 @@
 # Command to generate the SdkSplitProperties file for sandboxed SDK dependencies.
+load("@rules_java//java:defs.bzl", "java_library")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/apidescriptors/BUILD b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/apidescriptors/BUILD
index 8f975eaa8..7365ecc74 100644
--- a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/apidescriptors/BUILD
+++ b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/apidescriptors/BUILD
@@ -1,4 +1,5 @@
 # Tests for extract-api-descriptors command.
+load("@rules_java//java:defs.bzl", "java_test")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD
index a9c531e0c..d66bfc10f 100644
--- a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD
+++ b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/runtimeenabledsdkconfig/BUILD
@@ -1,4 +1,5 @@
 # Tests for generate-runtime-enabled-sdk-config command.
+load("@rules_java//java:defs.bzl", "java_test")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD
index 84d1663f4..00dc34830 100644
--- a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD
+++ b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdkdependenciesmanifest/BUILD
@@ -1,4 +1,5 @@
 # Tests for generate-sdk-dependencies-manifest command.
+load("@rules_java//java:defs.bzl", "java_test")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD
index e447356eb..63fa85bfd 100644
--- a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD
+++ b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/sdksplitproperties/BUILD
@@ -1,4 +1,5 @@
 # Tests for generate-sdk-split-properties command.
+load("@rules_java//java:defs.bzl", "java_test")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/validatemodulesconfig/BUILD b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/validatemodulesconfig/BUILD
index 38470ea3b..a1d2c793a 100644
--- a/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/validatemodulesconfig/BUILD
+++ b/src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/validatemodulesconfig/BUILD
@@ -1,4 +1,5 @@
 # Tests for validate-modules-config command.
+load("@rules_java//java:defs.bzl", "java_test")
 
 package(
     default_applicable_licenses = ["//:license"],
@@ -11,7 +12,6 @@ java_test(
     name = "ValidateModulesConfigCommandTest",
     size = "small",
     srcs = ["ValidateModulesConfigCommandTest.java"],
-    data = glob(["testdata/*"]),
     deps = [
         "//src/tools/javatests/com/google/devtools/build/android/sandboxedsdktoolbox/utils",
         "@rules_android_maven//:com_android_tools_build_bundletool",
diff --git a/test/rules/android_sdk_repository/BUILD b/test/rules/android_sdk_repository/BUILD
index 7917c5a87..2061c7e1a 100644
--- a/test/rules/android_sdk_repository/BUILD
+++ b/test/rules/android_sdk_repository/BUILD
@@ -6,6 +6,7 @@ load(
     "@rules_bazel_integration_test//bazel_integration_test:defs.bzl",
     "script_test",
 )
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/test/utils/integration_demo/BUILD b/test/utils/integration_demo/BUILD
index ddc7012d4..163c7c235 100644
--- a/test/utils/integration_demo/BUILD
+++ b/test/utils/integration_demo/BUILD
@@ -3,6 +3,7 @@ load(
     "@rules_bazel_integration_test//bazel_integration_test:defs.bzl",
     "script_test",
 )
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 package(
     default_applicable_licenses = ["//:license"],
diff --git a/toolchains/android/BUILD b/toolchains/android/BUILD
index 3741ee815..941fbe17f 100644
--- a/toolchains/android/BUILD
+++ b/toolchains/android/BUILD
@@ -1,8 +1,9 @@
 # Description:
 #   Defines the Android toolchain.
 
-load(":toolchain.bzl", "android_toolchain")
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
+load(":toolchain.bzl", "android_toolchain")
 
 licenses(["notice"])
 
diff --git a/tools/android/BUILD b/tools/android/BUILD
index 7c2e7e419..c7c2e2732 100644
--- a/tools/android/BUILD
+++ b/tools/android/BUILD
@@ -1,5 +1,6 @@
 load("@rules_java//java:defs.bzl", "java_binary", "java_library", "java_plugin")
 load("@rules_python//python:defs.bzl", "py_binary", "py_library", "py_test")
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 load(":defs.bzl", "android_jar", "run_ijar", "run_singlejar")
 
 package(
diff --git a/tools/android/defs.bzl b/tools/android/defs.bzl
index 3453c70c1..e5a507316 100644
--- a/tools/android/defs.bzl
+++ b/tools/android/defs.bzl
@@ -45,7 +45,7 @@ run_singlejar = rule(
     implementation = _run_singlejar_impl,
     doc = "Runs singlejar over the given files.",
     attrs = {
-        "srcs": attr.label_list(mandatory = True),
+        "srcs": attr.label_list(mandatory = True, allow_files = True),
         "out": attr.output(mandatory = True),
         "include_prefixes": attr.string_list(),
         "_java_toolchain": attr.label(default = Label("//tools/jdk:toolchain")),
diff --git a/tools/android/xslt/BUILD b/tools/android/xslt/BUILD
index b9a60b015..5f1869949 100644
--- a/tools/android/xslt/BUILD
+++ b/tools/android/xslt/BUILD
@@ -1,3 +1,5 @@
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
+
 exports_files(["add_g3itr.xslt"])
 
 sh_binary(