diff --git a/.bazelrc b/.bazelrc
index f92209fa9e1..4e90fc4cffb 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -12,15 +12,18 @@ build --test_timeout=1,15,60,240
 
 # Not using bzlmod for dependencies yet
 common --noenable_bzlmod
+common --enable_workspace
 
-# Use plus in repo names for Bazel 7 as long as it's used to address some resolution issues
-# Bazel 8 brings this behavior by default and this line can be removed after Bazel upgrade.
-common --incompatible_use_plus_in_repo_names
+# As part of starlarkification, Bazel 8 removes a number of rules which now need to be imported from
+# other repositories. In the long term, load() statements will be needed to import these rules. For
+# now, we can still autoload the affected repositories when needed. Do this only for a few
+# handpicked rules_python rules_shell, and protobuf components instead of the larger default
+# autoload set – some dependencies aren't importing the required shell rules yet, but we don't want
+# to accidentally rely on autoloading more dependencies.
+build --incompatible_autoload_externally="+py_binary,+py_library,+ProtoInfo,+sh_binary,+proto_library,+cc_proto_library"
 
 # bazel7 enables Build without the Bytes (BwoB) by default. This significantly speeds up builds
-# using the remote cache since less data needs to be fetched. Set remote_cache_eviction_retries
-# which is required to fully support a "dumb" cache. Bazel 8 already sets this value by default.
-build --experimental_remote_cache_eviction_retries=5
+# using the remote cache since less data needs to be fetched.
 # Note that we use remote_download_minimal for test builds, which avoids fetching build outputs
 # where possible. While several previous BwoB bugs have been fixed, this is slower than it could be
 # due to https://github.com/bazelbuild/bazel/issues/20576.
@@ -31,12 +34,6 @@ import %workspace%/build/ci.bazelrc
 
 import %workspace%/build/lint.bazelrc
 
-# Avoid generating duplicate runfile trees. This will become the default in a future bazel version.
-build --nolegacy_external_runfiles
-
-# Flip this early to avoid breaking compatibility once it becomes the default.
-build --incompatible_disallow_empty_glob
-
 # Prevents bazel cache invalidation when switching terminals
 build --incompatible_strict_action_env
 
diff --git a/.bazelversion b/.bazelversion
index e8be68404bc..2b0aa21219d 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-7.6.1
+8.2.1
diff --git a/.github/workflows/_bazel.yml b/.github/workflows/_bazel.yml
index 14f34d5cc2d..5a3edca4ba4 100644
--- a/.github/workflows/_bazel.yml
+++ b/.github/workflows/_bazel.yml
@@ -83,6 +83,13 @@ jobs:
       - name: Configure git hooks
         # Configure git to quell an irrelevant warning for runners (they never commit / push).
         run: git config core.hooksPath githooks
+      - name: Bazel build (Windows workaround)
+        if: runner.os == 'Windows'
+        # HACK: Work around Bazel Windows bug: Some targets need to be compiled without symlink
+        # support. Since we still need symlinks to compile C++ code properly, compile these targets
+        # separately.
+        run: |
+          bazel --nowindows_enable_symlinks build ${{ inputs.extra_bazel_args }} --config=ci --config=ci-${{ inputs.os_name }}${{ inputs.suffix }} --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev //src/wpt:wpt-all@tsproject //src/node:node@tsproject //src/pyodide:pyodide_static@tsproject
       - name: Bazel build
         # timestamps are no longer being added here, the GitHub logs include timestamps (Use
         # 'Show timestamps' on the web interface)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b36fa5757a7..c9d499aa2c1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -144,6 +144,13 @@ jobs:
             # Strip comment in front of WORKERS_MIRROR_URL, then substitute secret to use it.
             sed -e '/WORKERS_MIRROR_URL/ { s@# *@@; s@WORKERS_MIRROR_URL@${{ secrets.WORKERS_MIRROR_URL }}@; }' -i.bak WORKSPACE
           fi
+      - name: Bazel build (Windows workaround)
+        if: runner.os == 'Windows'
+        # HACK: Work around Bazel Windows bug: Some targets need to be compiled without symlink
+        # support. Since we still need symlinks to compile C++ code properly, compile these targets
+        # separately.
+        run: |
+          bazel --nowindows_enable_symlinks build --disk_cache=~/bazel-disk-cache --strip=always --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev --config=ci --config=${{ matrix.bazel-config }} //src/wpt:wpt-all@tsproject //src/node:node@tsproject //src/pyodide:pyodide_static@tsproject
       - name: Bazel build
         # Strip debug info here – we don't generate debug info but some is pulled in from external
         # static libraries, for example the Rust STL. This is equivalent to the -Wl,-S linker
diff --git a/.gitignore b/.gitignore
index c21a8aae163..2e27c2dd6e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,6 +16,8 @@ package-lock.json
 /external
 # Bazel output symlinks: Same reasoning as /external. You need the * because people can change the name of the directory your repository is cloned into, changing the bazel-<workspace_name> symlink.
 /bazel-*
+# Bazel 8's MODULE lock, since we're not actually locking anything yet.
+MODULE.bazel.lock
 # Compiled output -> don't check in
 /compile_commands.json
 /rust-project.json
diff --git a/MODULE.bazel b/MODULE.bazel
new file mode 100644
index 00000000000..af095bf0a1b
--- /dev/null
+++ b/MODULE.bazel
@@ -0,0 +1 @@
+# We don't use bzlmod at this time, but bazel 8 still expects us to have a MODULE.bazel file.
diff --git a/build/deps/build_deps.jsonc b/build/deps/build_deps.jsonc
index 117170f4e19..3e82c0d355e 100644
--- a/build/deps/build_deps.jsonc
+++ b/build/deps/build_deps.jsonc
@@ -88,6 +88,14 @@
       "repo": "rules_cc",
       "file_regex": "^rules_cc-"
     },
+    {
+      // Appears to be needed with Bazel 8
+      "name": "rules_java",
+      "type": "github_release",
+      "owner": "bazelbuild",
+      "repo": "rules_java",
+      "file_regex": "^rules_java-"
+    },
     {
       "name": "rules_shell",
       "type": "github_release",
diff --git a/build/deps/gen/build_deps.bzl b/build/deps/gen/build_deps.bzl
index 6847f61a899..5c454c02e93 100644
--- a/build/deps/gen/build_deps.bzl
+++ b/build/deps/gen/build_deps.bzl
@@ -16,6 +16,7 @@ load("@//build/deps:gen/dep_clang_format_linux_arm64.bzl", "dep_clang_format_lin
 load("@//build/deps:gen/dep_com_google_benchmark.bzl", "dep_com_google_benchmark")
 load("@//build/deps:gen/dep_platforms.bzl", "dep_platforms")
 load("@//build/deps:gen/dep_rules_cc.bzl", "dep_rules_cc")
+load("@//build/deps:gen/dep_rules_java.bzl", "dep_rules_java")
 load("@//build/deps:gen/dep_rules_nodejs.bzl", "dep_rules_nodejs")
 load("@//build/deps:gen/dep_rules_python.bzl", "dep_rules_python")
 load("@//build/deps:gen/dep_rules_rust.bzl", "dep_rules_rust")
@@ -33,6 +34,7 @@ def deps_gen():
     dep_cargo_bazel_macos_arm64()
     dep_cargo_bazel_win_x64()
     dep_rules_cc()
+    dep_rules_java()
     dep_rules_shell()
     dep_aspect_rules_esbuild()
     dep_rules_nodejs()
diff --git a/build/deps/gen/dep_rules_java.bzl b/build/deps/gen/dep_rules_java.bzl
new file mode 100644
index 00000000000..cea5d05cffe
--- /dev/null
+++ b/build/deps/gen/dep_rules_java.bzl
@@ -0,0 +1,18 @@
+# WARNING: THIS FILE IS AUTOGENERATED BY update-deps.py DO NOT EDIT
+
+load("@//:build/http.bzl", "http_archive")
+
+TAG_NAME = "8.9.0"
+URL = "https://github.com/bazelbuild/rules_java/releases/download/8.9.0/rules_java-8.9.0.tar.gz"
+STRIP_PREFIX = "./"
+SHA256 = "8daa0e4f800979c74387e4cd93f97e576ec6d52beab8ac94710d2931c57f8d8b"
+TYPE = "tgz"
+
+def dep_rules_java():
+    http_archive(
+        name = "rules_java",
+        url = URL,
+        strip_prefix = STRIP_PREFIX,
+        type = TYPE,
+        sha256 = SHA256,
+    )
diff --git a/src/pyodide/BUILD.bazel b/src/pyodide/BUILD.bazel
index c11b0c241b1..210688be355 100644
--- a/src/pyodide/BUILD.bazel
+++ b/src/pyodide/BUILD.bazel
@@ -1,5 +1,4 @@
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
-load("@workerd//:build/eslint_test.bzl", "eslint_test")
 load("//:build/python_metadata.bzl", "BUNDLE_VERSION_INFO")
 load(":helpers.bzl", "pyodide_extra", "pyodide_static", "python_bundles")
 
diff --git a/src/pyodide/helpers.bzl b/src/pyodide/helpers.bzl
index 23a2d07a10e..930028c0a06 100644
--- a/src/pyodide/helpers.bzl
+++ b/src/pyodide/helpers.bzl
@@ -131,12 +131,9 @@ def pyodide_static():
         [
             "internal/*.ts",
             "internal/topLevelEntropy/*.ts",
-            # The pool directory is only needed by typescript, it shouldn't be used at runtime.
-            "internal/pool/*.ts",
             "types/*.ts",
             "types/*/*.ts",
         ],
-        allow_empty = True,
     )
     modules = ["python-entrypoint-helper.ts"]
 
@@ -270,9 +267,11 @@ def _python_bundle(version, *, pyodide_asm_wasm = None, pyodide_asm_js = None, p
     else:
         esbuild(
             name = "emscriptenSetup@" + version,
+            # exclude emscriptenSetup from source set so that rules_ts won't also try to create a JS output
+            # for it. The file is provided in entry_point instead.
             srcs = native.glob([
                 "internal/pool/*.ts",
-            ]) + [
+            ], exclude = ["internal/pool/emscriptenSetup.ts"]) + [
                 _out_path("pyodide.asm.js", version),
                 "internal/util.ts",
             ],