diff --git a/.bazelrc b/.bazelrc
index 679eeec77a32..8687f4406cb9 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -11,6 +11,8 @@ build --compilation_mode opt
 common --override_module=semmle_code=%workspace%/misc/bazel/semmle_code_stub
 
 build --repo_env=CC=clang --repo_env=CXX=clang++
+# Disable Android SDK auto-detection (we don't use it, and rules_android has Bazel 9 compatibility issues)
+build --repo_env=ANDROID_HOME=
 
 # print test output, like sembuild does.
 # Set to `errors` if this is too verbose.
@@ -34,7 +36,7 @@ common --@rules_dotnet//dotnet/settings:strict_deps=false
 common --@rules_rust//rust/toolchain/channel=nightly
 
 # Reduce this eventually to empty, once we've fixed all our usages of java, and https://github.com/bazel-contrib/rules_go/issues/4193 is fixed
-common --incompatible_autoload_externally="+@rules_java,+@rules_shell"
+common --incompatible_autoload_externally="+@rules_cc,+@rules_java,+@rules_shell"
 
 build --java_language_version=17
 build --tool_java_language_version=17
diff --git a/.bazelversion b/.bazelversion
index e7fdef7e2e63..f7ee06693c17 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-8.4.2
+9.0.0
diff --git a/MODULE.bazel b/MODULE.bazel
index 9b326127ce7b..7fb06f3074f5 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -15,17 +15,19 @@ local_path_override(
 # see https://registry.bazel.build/ for a list of available packages
 
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "rules_go", version = "0.56.1")
+bazel_dep(name = "rules_cc", version = "0.2.16")
+bazel_dep(name = "rules_go", version = "0.59.0")
+bazel_dep(name = "rules_java", version = "9.0.3")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
-bazel_dep(name = "rules_nodejs", version = "6.2.0-codeql.1")
+bazel_dep(name = "rules_nodejs", version = "6.7.3")
 bazel_dep(name = "rules_python", version = "0.40.0")
 bazel_dep(name = "rules_shell", version = "0.5.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
-bazel_dep(name = "rules_kotlin", version = "2.2.0-codeql.1")
-bazel_dep(name = "gazelle", version = "0.40.0")
+bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")
+bazel_dep(name = "gazelle", version = "0.47.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
 bazel_dep(name = "rules_rust", version = "0.66.0")
@@ -188,6 +190,15 @@ pip.parse(
 )
 use_repo(pip, "codegen_deps")
 
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(
+    is_default = True,
+    python_version = "3.12",
+)
+use_repo(python, "python_3_12", "python_versions")
+
+register_toolchains("@python_versions//3.12:all")
+
 swift_deps = use_extension("//swift/third_party:load.bzl", "swift_deps")
 
 # following list can be kept in sync with `bazel mod tidy`
diff --git a/javascript/extractor/BUILD.bazel b/javascript/extractor/BUILD.bazel
index 360dc9370f94..363ea42864fd 100644
--- a/javascript/extractor/BUILD.bazel
+++ b/javascript/extractor/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@rules_java//java:defs.bzl", "java_library")
 load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
 load("@semmle_code//:common.bzl", "codeql_fat_jar", "codeql_java_project")
 
diff --git a/javascript/extractor/test/com/semmle/js/extractor/test/BUILD.bazel b/javascript/extractor/test/com/semmle/js/extractor/test/BUILD.bazel
index 1bad97bb7cc8..2d6a5d01c660 100644
--- a/javascript/extractor/test/com/semmle/js/extractor/test/BUILD.bazel
+++ b/javascript/extractor/test/com/semmle/js/extractor/test/BUILD.bazel
@@ -1,3 +1,5 @@
+load("@rules_java//java:defs.bzl", "java_test")
+
 java_test(
     name = "test",
     srcs = glob(["**/*.java"]),
diff --git a/misc/bazel/cmake/cmake.bzl b/misc/bazel/cmake/cmake.bzl
index d98a480c69cd..8235b249a2e4 100644
--- a/misc/bazel/cmake/cmake.bzl
+++ b/misc/bazel/cmake/cmake.bzl
@@ -1,3 +1,5 @@
+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
+
 CmakeInfo = provider(
     fields = {
         "name": "",
diff --git a/misc/bazel/internal/zipmerge/BUILD.bazel b/misc/bazel/internal/zipmerge/BUILD.bazel
index 07cbb34ce978..4b2723d6c64a 100644
--- a/misc/bazel/internal/zipmerge/BUILD.bazel
+++ b/misc/bazel/internal/zipmerge/BUILD.bazel
@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_test")
+
 cc_library(
     name = "lib",
     srcs = [
@@ -28,7 +30,7 @@ cc_test(
     linkstatic = True,  # required to build the test in the internal repo
     deps = [
         ":lib",
-        "@bazel_tools//tools/cpp/runfiles",
         "@googletest//:gtest_main",
+        "@rules_cc//cc/runfiles",
     ],
 )
diff --git a/misc/bazel/internal/zipmerge/zipmerge_test.cpp b/misc/bazel/internal/zipmerge/zipmerge_test.cpp
index 65278a679f5b..616365c7cbdb 100644
--- a/misc/bazel/internal/zipmerge/zipmerge_test.cpp
+++ b/misc/bazel/internal/zipmerge/zipmerge_test.cpp
@@ -9,9 +9,9 @@
 
 #include <gtest/gtest.h>
 #include <gmock/gmock.h>
-#include "tools/cpp/runfiles/runfiles.h"
+#include "rules_cc/cc/runfiles/runfiles.h"
 
-using bazel::tools::cpp::runfiles::Runfiles;
+using rules_cc::cc::runfiles::Runfiles;
 using namespace std::string_literals;
 namespace fs = std::filesystem;
 
diff --git a/misc/bazel/registry/fix.py b/misc/bazel/registry/fix.py
index 863c832be59d..57a2bf3b3f97 100755
--- a/misc/bazel/registry/fix.py
+++ b/misc/bazel/registry/fix.py
@@ -62,10 +62,10 @@ def update(data):
         patch_json(
             version / "source.json",
             patches={
-                p.name: sha256(p) for p in patches.iterdir()
+                p.name: sha256(p) for p in sorted(patches.iterdir())
             } if patches.is_dir() else None,
             patch_strip=1 if patches.is_dir() else None,
             overlay={
-                o.name: sha256(o) for o in overlay.iterdir()
+                o.name: sha256(o) for o in sorted(overlay.iterdir())
             } if overlay.is_dir() else None,
         )
diff --git a/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/source.json b/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/source.json
deleted file mode 100644
index bfa243b5a22e..000000000000
--- a/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/source.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-    "integrity": "sha256-4STROYYIW8ChW+LIXBQVurVwhEK3jSSf4iv430OlNA0=",
-    "url": "https://github.com/bazelbuild/rules_kotlin/releases/download/v2.2.0/rules_kotlin-v2.2.0.tar.gz",
-    "patches": {
-        "codeql_do_not_emit_jdeps.patch": "sha256-gIlhXEY71vlCkpr5wj2vm3yv6RwcuKLhgbTGqdVvQfU=",
-        "codeql_add_language_version_option.patch": "sha256-HoH8NWXxmYHmm/SxaugRdXgMntvcQx5gRLW2yQIvWhM="
-    },
-    "patch_strip": 1
-}
diff --git a/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/MODULE.bazel b/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/MODULE.bazel
similarity index 86%
rename from misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/MODULE.bazel
rename to misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/MODULE.bazel
index df66ce2051ab..ec37914a8f73 100644
--- a/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/MODULE.bazel
+++ b/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/MODULE.bazel
@@ -1,19 +1,21 @@
 module(
     name = "rules_kotlin",
-    version = "2.2.0-codeql.1",
+    version = "2.2.2-codeql.1",
     compatibility_level = 1,
     repo_name = "rules_kotlin",
 )
 
 bazel_dep(name = "platforms", version = "0.0.11")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
-bazel_dep(name = "rules_java", version = "7.2.0")
+bazel_dep(name = "rules_java", version = "8.9.0")
 bazel_dep(name = "rules_android", version = "0.6.4")
 bazel_dep(name = "bazel_features", version = "1.25.0")
 bazel_dep(name = "protobuf", version = "29.0", repo_name = "com_google_protobuf")
 bazel_dep(name = "rules_proto", version = "6.0.2", repo_name = "rules_proto")
 bazel_dep(name = "abseil-py", version = "2.1.0", repo_name = "py_absl")
 bazel_dep(name = "rules_cc", version = "0.0.16")
+bazel_dep(name = "bazel_worker_api", version = "0.0.8")
+bazel_dep(name = "bazel_worker_java", version = "0.0.8")
 
 rules_java_toolchains = use_extension("@rules_java//java:extensions.bzl", "toolchains")
 use_repo(rules_java_toolchains, "remote_java_tools")
diff --git a/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/patches/codeql_add_language_version_option.patch b/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/patches/codeql_add_language_version_option.patch
similarity index 100%
rename from misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/patches/codeql_add_language_version_option.patch
rename to misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/patches/codeql_add_language_version_option.patch
diff --git a/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/patches/codeql_do_not_emit_jdeps.patch b/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/patches/codeql_do_not_emit_jdeps.patch
similarity index 93%
rename from misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/patches/codeql_do_not_emit_jdeps.patch
rename to misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/patches/codeql_do_not_emit_jdeps.patch
index e6b71ab0c4f5..838750ba12eb 100644
--- a/misc/bazel/registry/modules/rules_kotlin/2.2.0-codeql.1/patches/codeql_do_not_emit_jdeps.patch
+++ b/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/patches/codeql_do_not_emit_jdeps.patch
@@ -1,6 +1,7 @@
 Emitting jdeps is broken for the 2.0.0 kotlin extractor, and we don't need those files.
 Patching it here rather than passing `--@rules_kotlin//kotlin/settings:jvm_emit_jdeps=false`
-allows us to not have to specify that option (and therefore pull in `rules_kotlin`) in `semmle-code`.
+allows us to not have to specify that option (and therefore pull in `rules_kotlin`) in the
+internal repo.
 --- a/kotlin/settings/BUILD.bazel
 +++ b/kotlin/settings/BUILD.bazel
 @@ -16,6 +16,6 @@ release_archive(
diff --git a/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/source.json b/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/source.json
new file mode 100644
index 000000000000..7025fb00a273
--- /dev/null
+++ b/misc/bazel/registry/modules/rules_kotlin/2.2.2-codeql.1/source.json
@@ -0,0 +1,9 @@
+{
+    "integrity": "sha256-QR2yavs0ksyDUbW1NJkxUir+LFTyZRttEncwoSVtD2A=",
+    "url": "https://github.com/bazelbuild/rules_kotlin/releases/download/v2.2.2/rules_kotlin-v2.2.2.tar.gz",
+    "patches": {
+        "codeql_add_language_version_option.patch": "sha256-HoH8NWXxmYHmm/SxaugRdXgMntvcQx5gRLW2yQIvWhM=",
+        "codeql_do_not_emit_jdeps.patch": "sha256-cg06knW+Eq13qHCaelbnZka/WnGPvRrcqXHtpXsy/rA="
+    },
+    "patch_strip": 1
+}
diff --git a/misc/bazel/registry/modules/rules_kotlin/metadata.json b/misc/bazel/registry/modules/rules_kotlin/metadata.json
index 3609865f4d5b..ea756f783643 100644
--- a/misc/bazel/registry/modules/rules_kotlin/metadata.json
+++ b/misc/bazel/registry/modules/rules_kotlin/metadata.json
@@ -21,7 +21,7 @@
         "github:bazelbuild/rules_kotlin"
     ],
     "versions": [
-        "2.2.0-codeql.1",
+        "2.2.2-codeql.1"
     ],
     "yanked_versions": {}
 }
diff --git a/misc/codegen/BUILD.bazel b/misc/codegen/BUILD.bazel
index c7b88de96b7d..90e9842a9410 100644
--- a/misc/codegen/BUILD.bazel
+++ b/misc/codegen/BUILD.bazel
@@ -5,6 +5,9 @@ py_binary(
     srcs = ["codegen.py"],
     data = [
         "//misc/codegen/templates:cpp",
+        "//misc/codegen/templates:dbscheme",
+        "//misc/codegen/templates:ql",
+        "//misc/codegen/templates:rust",
         "//misc/codegen/templates:trap",
     ],
     visibility = ["//visibility:public"],
diff --git a/misc/codegen/templates/BUILD.bazel b/misc/codegen/templates/BUILD.bazel
index a86346245af1..9068cc7f66ec 100644
--- a/misc/codegen/templates/BUILD.bazel
+++ b/misc/codegen/templates/BUILD.bazel
@@ -1,5 +1,10 @@
 package(default_visibility = ["//misc/codegen:__subpackages__"])
 
+filegroup(
+    name = "dbscheme",
+    srcs = ["dbscheme.mustache"],
+)
+
 filegroup(
     name = "trap",
     srcs = glob(["trap_*.mustache"]),
@@ -9,3 +14,13 @@ filegroup(
     name = "cpp",
     srcs = glob(["cpp_*.mustache"]),
 )
+
+filegroup(
+    name = "ql",
+    srcs = glob(["ql_*.mustache"]),
+)
+
+filegroup(
+    name = "rust",
+    srcs = glob(["rust_*.mustache"]),
+)
diff --git a/shared/cpp/BUILD.bazel b/shared/cpp/BUILD.bazel
index 5debed90086c..f78c4ede92fa 100644
--- a/shared/cpp/BUILD.bazel
+++ b/shared/cpp/BUILD.bazel
@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
 cc_library(
     name = "extractor_shared",
     srcs = glob(["*.cpp"]),
diff --git a/swift/logging/BUILD.bazel b/swift/logging/BUILD.bazel
index 1d6192b3c13a..e72a7071d069 100644
--- a/swift/logging/BUILD.bazel
+++ b/swift/logging/BUILD.bazel
@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
 cc_library(
     name = "logging",
     srcs = glob(["*.cpp"]),
diff --git a/swift/rules.bzl b/swift/rules.bzl
index cb16ca4382ad..d479f6bff112 100644
--- a/swift/rules.bzl
+++ b/swift/rules.bzl
@@ -1,3 +1,4 @@
+load("@rules_cc//cc:defs.bzl", "CcInfo", "cc_binary", "cc_library")
 load("//misc/bazel:os.bzl", "os_select")
 
 # TODO: make a shared library with the internal repos for transitions
@@ -124,7 +125,7 @@ def _wrap_cc(rule, kwargs):
     )
 
 def swift_cc_binary(**kwargs):
-    _wrap_cc(native.cc_binary, kwargs)
+    _wrap_cc(cc_binary, kwargs)
 
 def swift_cc_library(**kwargs):
-    _wrap_cc(native.cc_library, kwargs)
+    _wrap_cc(cc_library, kwargs)