diff --git a/build-chroot/bazel-0.24.0.deb.sha256 b/build-chroot/bazel-0.24.0.deb.sha256
deleted file mode 100644
index 3c189e993..000000000
--- a/build-chroot/bazel-0.24.0.deb.sha256
+++ /dev/null
@@ -1 +0,0 @@
-550fd7ac2bf7c884600bb051d4875e3e11896d645b22609ac86c40deaec6cf92  bazel-0.24.0.deb
diff --git a/build-chroot/bazel-0.26.1.deb.sha256 b/build-chroot/bazel-0.26.1.deb.sha256
new file mode 100644
index 000000000..e6db6febb
--- /dev/null
+++ b/build-chroot/bazel-0.26.1.deb.sha256
@@ -0,0 +1 @@
+c0b2b676ca7cc071a98f969aefb4a9d4b7db1858b7340d9db6f8076179e776cd  bazel-0.26.1.deb
diff --git a/build-chroot/bazel-keyring.gpg b/build-chroot/bazel-keyring.gpg
new file mode 100644
index 000000000..cf8fad580
Binary files /dev/null and b/build-chroot/bazel-keyring.gpg differ
diff --git a/build-chroot/bump-pinned-bazel.sh b/build-chroot/bump-pinned-bazel.sh
new file mode 100755
index 000000000..647f4a08a
--- /dev/null
+++ b/build-chroot/bump-pinned-bazel.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e -u
+
+# This script bumps the version of bazel to a newer version.
+
+BASEPATH="$(realpath "$(dirname "$0")")"
+
+WORKDIR=$(mktemp -d)
+trap "rm -r $WORKDIR" EXIT
+
+cd "$WORKDIR"
+
+if [ "${1:-}" = "" ]
+then
+	echo "usage: bump-pinned-bazel.sh <version>" 1>&2
+	exit 1
+fi
+
+VERSION="$1"
+
+curl -L -o "bazel-${VERSION}.deb" "https://github.com/bazelbuild/bazel/releases/download/${VERSION}/bazel_${VERSION}-linux-x86_64.deb"
+curl -L -o "bazel-${VERSION}.deb.sig" "https://github.com/bazelbuild/bazel/releases/download/${VERSION}/bazel_${VERSION}-linux-x86_64.deb.sig"
+gpg --no-default-keyring --keyring "${BASEPATH}/bazel-keyring.gpg" --trust-mode=always --verify "bazel-${VERSION}.deb.sig"
+sha256sum "bazel-${VERSION}.deb" >"${BASEPATH}/bazel-${VERSION}.deb.sha256"
+rm "bazel-${VERSION}.deb" "bazel-${VERSION}.deb.sig"
+sed -i 's/^VERSION=".*"$/VERSION="'"${VERSION}"'"/' "${BASEPATH}/install-bazel.sh"
+
+echo "Bazel bumped. Please take the following steps:"
+echo "  - git add bazel-${VERSION}.deb.sha256 install-bazel.sh"
+echo "  - Remove the old bazel .sha256 entry"
+echo "  - Make a commit with the first line:"
+echo "      bazel: bump to ${VERSION}"
diff --git a/build-chroot/install-bazel.sh b/build-chroot/install-bazel.sh
index a393c87e0..8509ae06a 100755
--- a/build-chroot/install-bazel.sh
+++ b/build-chroot/install-bazel.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e -u
 
-VERSION="0.24.0"
+VERSION="0.26.1"
 
 cd "$(dirname "$0")"
 curl -L -o "bazel-${VERSION}.deb" "https://github.com/bazelbuild/bazel/releases/download/${VERSION}/bazel_${VERSION}-linux-x86_64.deb"
diff --git a/platform/WORKSPACE b/platform/WORKSPACE
index 457c5ff8d..dc78bdde5 100644
--- a/platform/WORKSPACE
+++ b/platform/WORKSPACE
@@ -4,40 +4,50 @@ load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 # TODO: audit all downloads, make sure they're all source code
 http_archive(
     name = "io_bazel_rules_go",
-    urls = ["https://github.com/bazelbuild/rules_go/releases/download/0.18.3/rules_go-0.18.3.tar.gz"],
-    sha256 = "86ae934bd4c43b99893fc64be9d9fc684b81461581df7ea8fc291c816f5ee8c5",
+    urls = ["https://github.com/bazelbuild/rules_go/releases/download/0.19.3/rules_go-0.19.3.tar.gz"],
+    sha256 = "313f2c7a23fecc33023563f082f381a32b9b7254f727a7dd2d6380ccc6dfe09b",
 )
+load("@io_bazel_rules_go//go:deps.bzl", "go_rules_dependencies", "go_register_toolchains")
+go_rules_dependencies()
+# TODO: stop using binaries built by upstream; use our own
+go_register_toolchains(
+    go_version = "1.12.4",
+)
+load("//bazel:gorepo_patchfix.bzl", "go_repository_alt")
+
+# gazelle
 
 http_archive(
     name = "bazel_gazelle",
     urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/0.17.0/bazel-gazelle-0.17.0.tar.gz"],
     sha256 = "3c681998538231a2d24d0c07ed5a7658cb72bfb5fd4bf9911157c0e9ac6a2687",
 )
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
+gazelle_dependencies()
 
-load("@io_bazel_rules_go//go:deps.bzl", "go_rules_dependencies", "go_register_toolchains")
-
-go_rules_dependencies()
+# protobuf
 
-# TODO: stop using binaries built by upstream; use our own
-go_register_toolchains(
-    go_version = "1.12.4",
+git_repository(
+    name = "com_google_protobuf",
+    commit = "6a59a2ad1f61d9696092f79b6d74368b4d7970a3", # 3.9.0
+    remote = "https://github.com/protocolbuffers/protobuf",
+    shallow_since = "1558721209 -0700",
 )
+load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+protobuf_deps()
 
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
-load("//bazel:gorepo_patchfix.bzl", "go_repository_alt")
-
-gazelle_dependencies()
+# rules_docker
 
 git_repository(
     name = "io_bazel_rules_docker",
     remote = "https://github.com/bazelbuild/rules_docker",
     commit = "968e0b7c8b3bc7e009531231ac926325cd2745bc",
 )
-
 load("@io_bazel_rules_docker//repositories:repositories.bzl", container_repositories = "repositories")
-
 container_repositories()
 
+# k8s repository infrastructure tools, k8s
+
 git_repository(
     name = "io_k8s_repo_infra",
     remote = "https://github.com/kubernetes/repo-infra/",
@@ -229,12 +239,24 @@ go_repository(
     importpath = "github.com/modern-go/concurrent",
 )
 
+go_repository(
+    name = "org_golang_x_net",
+    commit = "da137c7871d730100384dbcf36e6f8fa493aef5b",
+    importpath = "golang.org/x/net",
+)
+
 go_repository(
     name = "org_golang_x_oauth2",
     commit = "a6bd8cefa1811bd24b86f8902872e4e8225f74c4",
     importpath = "golang.org/x/oauth2",
 )
 
+go_repository(
+    name = "org_golang_x_text",
+    commit = "f21a4dfb5e38f5895301dc265a8def02365cc3d0", # 0.3.0
+    importpath = "golang.org/x/text",
+)
+
 go_repository(
     name = "io_k8s_klog",
     commit = "8e90cee79f823779174776412c13478955131846",
@@ -261,6 +283,12 @@ go_repository(
 
 # keysystem dependencies
 
+go_repository(
+    name = "org_golang_x_sys",
+    commit = "fae7ac547cb717d141c433a2a173315e216b64c4",
+    importpath = "golang.org/x/sys",
+)
+
 go_repository(
     name = "org_golang_x_crypto",
     commit = "88737f569e3a9c7ab309cdc09a07fe7fc87233c3",
diff --git a/platform/bazel/BUILD.bazel b/platform/bazel/BUILD.bazel
index 0abef865f..165aa79d7 100644
--- a/platform/bazel/BUILD.bazel
+++ b/platform/bazel/BUILD.bazel
@@ -1,22 +1,22 @@
-native.py_binary(
+py_binary(
     name = "substitute",
     srcs = ["substitute.py"],
     visibility = ["//visibility:public"],
 )
 
-native.py_binary(
+py_binary(
     name = "version-compute",
     srcs = ["version-compute.py"],
     visibility = ["//visibility:public"],
 )
 
-native.py_binary(
+py_binary(
     name = "hash-compute",
     srcs = ["hash-compute.py"],
     visibility = ["//visibility:public"],
 )
 
-native.py_binary(
+py_binary(
     name = "cache-compute",
     srcs = ["cache-compute.py"],
     visibility = ["//visibility:public"],
diff --git a/platform/bazel/zip_file.bzl b/platform/bazel/zip_file.bzl
index 5529ee311..6f3f75da0 100644
--- a/platform/bazel/zip_file.bzl
+++ b/platform/bazel/zip_file.bzl
@@ -147,7 +147,7 @@ def collect_runfiles(targets):
     Returns:
       A list of Bazel files.
     """
-    data = depset()
+    data = []
     for target in targets:
         if hasattr(target, "runfiles"):
             data += target.runfiles.files
@@ -156,7 +156,7 @@ def collect_runfiles(targets):
             data += target.data_runfiles.files
         if hasattr(target, "default_runfiles"):
             data += target.default_runfiles.files
-    return data
+    return depset(data)
 
 def _zip_file(ctx):
     """Implementation of zip_file() rule."""
@@ -164,10 +164,8 @@ def _zip_file(ctx):
         if (s.startswith("/") or s.endswith("/") or
             d.startswith("/") or d.endswith("/")):
             fail("mappings should not begin or end with slash")
-    srcs = depset()
-    srcs += ctx.files.srcs
-    srcs += ctx.files.data
-    srcs += collect_runfiles(ctx.attr.data)
+    srcs = depset(ctx.files.srcs + ctx.files.data,
+                  transitive=[collect_runfiles(ctx.attr.data)]).to_list()
     mapped = _map_sources(ctx, srcs, ctx.attr.mappings)
     cmd = [
         "#!/bin/sh",
@@ -203,16 +201,12 @@ def _zip_file(ctx):
         'cd "${repo}"',
         'rm -rf "${tmp}"',
     ]
-    if hasattr(ctx, "bin_dir"):
-        script = ctx.new_file(ctx.bin_dir, "%s.sh" % ctx.label.name)
-    else:
-        # TODO(kchodorow): remove this once Bazel 4.0+ is required.
-        script = ctx.new_file(ctx.configuration.bin_dir, "%s.sh" % ctx.label.name)
-    ctx.file_action(output = script, content = "\n".join(cmd), executable = True)
+    script = ctx.actions.declare_file("%s.sh" % ctx.label.name)
+    ctx.actions.write(output = script, content = "\n".join(cmd), is_executable = True)
     inputs = [ctx.file._zipper]
     inputs += [dep.zip_file for dep in ctx.attr.deps]
-    inputs += srcs.to_list()
-    ctx.action(
+    inputs += srcs
+    ctx.actions.run(
         inputs = inputs,
         outputs = [ctx.outputs.out],
         executable = script,
@@ -281,6 +275,6 @@ zip_file = rule(
         "deps": attr.label_list(providers = ["zip_file"]),
         "exclude": attr.string_list(),
         "mappings": attr.string_dict(),
-        "_zipper": attr.label(default = Label(ZIPPER), single_file = True),
+        "_zipper": attr.label(default = Label(ZIPPER), allow_single_file = True),
     },
 )