diff --git a/bazel/.bazelrc b/bazel/.bazelrc
index 27b618914..3ce91d272 100644
--- a/bazel/.bazelrc
+++ b/bazel/.bazelrc
@@ -1 +1 @@
-common --enable_bzlmod=0
+common --enable_bzlmod
diff --git a/bazel/MODULE.bazel b/bazel/MODULE.bazel
index 4589887e5..ffafd19ec 100644
--- a/bazel/MODULE.bazel
+++ b/bazel/MODULE.bazel
@@ -1,28 +1,60 @@
 module(name = "envoy_toolshed", version = "")
 
-bazel_dep(name = "aspect_bazel_lib", version = "2.4.2")
-bazel_dep(name = "bazel_skylib", version = "1.5.0")
-bazel_dep(name = "rules_pkg", version = "0.7.0")
-bazel_dep(name = "rules_python", version = "0.31.0")
-bazel_dep(name = "rules_perl", version = "0.2.3")
+bazel_dep(name = "aspect_bazel_lib", version = "2.16.0")
+bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "rules_foreign_cc", version = "0.14.0")
+bazel_dep(name = "rules_perl", version = "0.4.1")
+bazel_dep(name = "rules_pkg", version = "1.0.1")
+bazel_dep(name = "rules_python", version = "1.4.1")
+bazel_dep(name = "rules_shell", version = "0.6.1")
+bazel_dep(name = "toolchains_llvm", version = "1.4.0")
 # -- bazel_dep definitions -- #
 
 bazel_lib_toolchains = use_extension("@aspect_bazel_lib//lib:extensions.bzl", "toolchains")
 bazel_lib_toolchains.jq()
 use_repo(bazel_lib_toolchains, "jq_toolchains")
 
+llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
+llvm.toolchain()
+
+use_repo(llvm, "llvm_toolchain")
+register_toolchains("@llvm_toolchain//:all")
+
+PYTHON_VERSIONS = [
+    "3.9",
+    "3.10",
+    "3.11",
+    "3.12",
+    "3.13",
+]
+
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
-python.toolchain(python_version = "3.11")
+[
+    python.toolchain(
+        is_default = python_version == PYTHON_VERSIONS[-1],
+        python_version = python_version,
+    )
+    for python_version in PYTHON_VERSIONS
+]
 
 pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
-pip.parse(
-    hub_name = "pip3",
-    python_version = "3.11",
-    requirements_lock = "//:requirements.txt",
-)
-pip.parse(
-    hub_name = "website_pip3",
-    python_version = "3.11",
-    requirements_lock = "//website:requirements.txt",
-)
+
+[
+    pip.parse(
+        hub_name = "pip3",
+        python_version = python_version,
+        requirements_lock = "//:requirements.txt",
+    )
+    for python_version in PYTHON_VERSIONS
+]
+[
+    pip.parse(
+        hub_name = "website_pip3",
+        python_version = python_version,
+        requirements_lock = "//website:requirements.txt",
+    )
+    for python_version in PYTHON_VERSIONS
+]
+
 use_repo(pip, "pip3", "website_pip3")
diff --git a/bazel/dependency/macros.bzl b/bazel/dependency/macros.bzl
index 2588c3e67..7a564d62a 100644
--- a/bazel/dependency/macros.bzl
+++ b/bazel/dependency/macros.bzl
@@ -1,3 +1,4 @@
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 def updater(
         name,
@@ -61,7 +62,7 @@ def updater(
         data += [post_script]
         env["VERSION_UPDATE_POST_SCRIPT"] = "$(location %s)" % post_script
 
-    native.sh_binary(
+    sh_binary(
         name = name,
         srcs = [update_script],
         data = data,
diff --git a/bazel/profiler/macros.bzl b/bazel/profiler/macros.bzl
index 047c81bbe..abfb78736 100644
--- a/bazel/profiler/macros.bzl
+++ b/bazel/profiler/macros.bzl
@@ -1,4 +1,5 @@
 load("@aspect_bazel_lib//lib:jq.bzl", "jq")
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 def rules_pools(
         name,
@@ -10,7 +11,7 @@ def rules_pools(
     """Generate a dict with keys being non-`default` pools, and values
     are a list of targets configured to use the pool.
     """
-    native.sh_binary(
+    sh_binary(
         name = "find_rules_pools",
         srcs = [pool_script],
         data = [
@@ -358,7 +359,7 @@ def ci_changes(
         """,
     )
 
-    native.sh_binary(
+    sh_binary(
         name = "update",
         srcs = [update_script],
         data = [
diff --git a/bazel/tarball/macros.bzl b/bazel/tarball/macros.bzl
index 0f2e369b7..2c0aa0f9d 100644
--- a/bazel/tarball/macros.bzl
+++ b/bazel/tarball/macros.bzl
@@ -1,3 +1,4 @@
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 def unpacker(
         name,
@@ -52,7 +53,7 @@ def unpacker(
         data += [zstd]
         env["ZSTD"] = "$(location %s)" % zstd
 
-    native.sh_binary(
+    sh_binary(
         name = name,
         srcs = [script],
         visibility = visibility,
diff --git a/bazel/utils.bzl b/bazel/utils.bzl
index e1047a413..e10cb4d65 100644
--- a/bazel/utils.bzl
+++ b/bazel/utils.bzl
@@ -1,3 +1,4 @@
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 def cat(name = "cat", flag = "target"):
     """
@@ -44,7 +45,7 @@ def cat(name = "cat", flag = "target"):
         srcs = [":%s" % flag],
     )
 
-    native.sh_binary(
+    sh_binary(
         name = name,
         srcs = ["%s_sh" % name],
         data = [":%s" % flag],
@@ -92,7 +93,7 @@ def jqcat(
         build_setting_default = ":jqempty",
     )
 
-    native.sh_binary(
+    sh_binary(
         name = name,
         srcs = [jq_script],
         data = [
diff --git a/bazel/versions.bzl b/bazel/versions.bzl
index 8b9788163..45d164722 100644
--- a/bazel/versions.bzl
+++ b/bazel/versions.bzl
@@ -117,6 +117,15 @@ VERSIONS = {
         "strip_prefix": "{name}-{version}",
     },
 
+    "rules_shell": {
+        "type": "github_archive",
+        "repo": "bazelbuild/rules_shell",
+        "version": "0.6.1",
+        "sha256": "e6b87c89bd0b27039e3af2c5da01147452f240f75d505f5b6880874f31036307",
+        "url": "https://github.com/{repo}/releases/download/v{version}/{name}-v{version}.tar.gz",
+        "strip_prefix": "{name}-{version}",
+    },
+
     "toolchains_llvm": {
         "type": "github_archive",
         "repo": "bazel-contrib/toolchains_llvm",