diff --git a/.bazelrc b/.bazelrc
index d5c30b39..55b803eb 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,2 +1,6 @@
 common --disk_cache=~/.cache/bazel-disk-cache
 common --repository_cache=~/.cache/bazel-repo-cache
+
+# Resolve protoc from a registered toolchain (toolchains_protoc provides a
+# prebuilt binary) instead of compiling protoc from source. Introduced in Bazel 7.
+common --incompatible_enable_proto_toolchain_resolution
diff --git a/MODULE.bazel b/MODULE.bazel
index d8e387f5..d44b8457 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,7 +1,18 @@
+# Listed first so its protoc toolchain wins resolution over the protobuf module's,
+# which is pulled in transitively by rules_go/rules_proto.
+bazel_dep(name = "toolchains_protoc", version = "0.6.1")
 bazel_dep(name = "rules_go", version = "0.57.0")
 bazel_dep(name = "gazelle", version = "0.45.0")
 bazel_dep(name = "rules_proto", version = "7.1.0")
 
+# Use a prebuilt protoc binary instead of compiling protoc (and its abseil/upb
+# dependencies) from source on every cold build. Requires
+# --incompatible_enable_proto_toolchain_resolution (set in .bazelrc).
+protoc = use_extension("@toolchains_protoc//protoc:extensions.bzl", "protoc")
+use_repo(protoc, "toolchains_protoc_hub")
+
+register_toolchains("@toolchains_protoc_hub//:all")
+
 GO_VERSION = "1.24.5"
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")