diff --git a/.bazelrc b/.bazelrc
index 23d1c5b6..0bd0e6ed 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1 +1,2 @@
 run --workspace_status_command="bash tools/workspace-status.sh"
+common --incompatible_enable_proto_toolchain_resolution
diff --git a/MODULE.bazel b/MODULE.bazel
index 2e4df22a..5c1cca48 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -7,6 +7,7 @@ bazel_dep(name = "gazelle", version = "0.42.0")
 bazel_dep(name = "googleapis", version = "0.0.0-20240819-fe8ba054a")
 bazel_dep(name = "jsonnet_go", version = "0.20.0")
 bazel_dep(name = "opentelemetry-proto", version = "1.5.0")
+bazel_dep(name = "toolchains_protoc", version = "0.4.2")  # must come BEFORE protobuf so the toolchain registration wins
 bazel_dep(name = "protobuf", version = "29.3")
 bazel_dep(name = "rules_go", version = "0.53.0")
 bazel_dep(name = "rules_jsonnet", version = "0.6.0")
@@ -31,6 +32,10 @@ single_version_override(
     patches = ["//:patches/jsonnet/bazel-8.diff"],
 )
 
+# Match protobuf above, until it ships a pre-built binary toolchain itself
+protoc = use_extension("@toolchains_protoc//protoc:extensions.bzl", "protoc")
+protoc.toolchain(version = "v29.3")
+
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(version = "1.24.0")
 
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 1a68e132..d8e5ca0f 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -247,6 +247,8 @@
     "https://bcr.bazel.build/modules/stardoc/0.7.1/source.json": "b6500ffcd7b48cd72c29bb67bcac781e12701cc0d6d55d266a652583cfcdab01",
     "https://bcr.bazel.build/modules/toolchains_llvm/1.3.0/MODULE.bazel": "6e02731e51f7eb2ec4b01c5e79e722bf738a631f6e03d9b4917cbf2cb027bee1",
     "https://bcr.bazel.build/modules/toolchains_llvm/1.3.0/source.json": "4ce0373a89c6df34dd37cd67285bb871d8e225d30dcb67dd093e077a04bbbb71",
+    "https://bcr.bazel.build/modules/toolchains_protoc/0.4.2/MODULE.bazel": "05a00ffcc77a1bb9bec936621a29865953e8a2fe06f9476bd050b10e9ea84ca3",
+    "https://bcr.bazel.build/modules/toolchains_protoc/0.4.2/source.json": "ddbdfcdc65c4b1e2533d3b8ca0b4b8975b921147d7501e9b556e3d3689f6e427",
     "https://bcr.bazel.build/modules/upb/0.0.0-20211020-160625a/MODULE.bazel": "6cced416be2dc5b9c05efd5b997049ba795e5e4e6fafbe1624f4587767638928",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
     "https://bcr.bazel.build/modules/upb/0.0.0-20230516-61a97ef/MODULE.bazel": "c0df5e35ad55e264160417fd0875932ee3c9dda63d9fccace35ac62f45e1b6f9",