diff --git a/.bazelignore b/.bazelignore
new file mode 100644
index 000000000..f321e2271
--- /dev/null
+++ b/.bazelignore
@@ -0,0 +1 @@
+example-workspace
diff --git a/.bazelversion b/.bazelversion
index 6abaeb2f9..a8a188756 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-6.2.0
+7.1.2
diff --git a/.gitignore b/.gitignore
index 4229c3a5a..a9b518c33 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 bazel-*
+MODULE.bazel.lock
 **/.DS_Store
 !vendor/*
 
diff --git a/MODULE.bazel b/MODULE.bazel
new file mode 100644
index 000000000..7489b28ad
--- /dev/null
+++ b/MODULE.bazel
@@ -0,0 +1,45 @@
+module(
+    name = "protoc-gen-validate",
+    repo_name = "com_envoyproxy_protoc_gen_validate",
+    version = "0",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "bazel_skylib", version = "1.5.0")
+bazel_dep(name = "gazelle", version = "0.36.0", repo_name = "bazel_gazelle")
+bazel_dep(name = "protobuf", version = "27.0-rc2", repo_name = "com_google_protobuf")
+bazel_dep(name = "re2", version = "2021-09-01", repo_name = "com_googlesource_code_re2")
+bazel_dep(name = "rules_cc", version = "0.0.9")
+bazel_dep(name = "rules_go", version = "0.48.0", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "rules_java", version = "7.4.0")
+bazel_dep(name = "rules_proto", version = "6.0.0")
+bazel_dep(name = "rules_python", version = "0.32.2")
+
+go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
+go_sdk.download(version = "1.21.1")
+
+go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
+go_deps.from_file(go_mod = "//:go.mod")
+use_repo(
+    go_deps,
+    "com_github_iancoleman_strcase",
+    "com_github_lyft_protoc_gen_star_v2",
+    "org_golang_google_protobuf",
+    "org_golang_x_net",
+)
+
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(
+    hub_name = "pgv_pip_deps",
+    python_version = "3.11",
+    requirements_lock = "//python:requirements.txt",
+)
+use_repo(pip, "pgv_pip_deps")
+
+non_module_deps = use_extension("//bazel:repositories.bzl", "non_module_deps")
+use_repo(
+    non_module_deps,
+    "com_google_guava",
+    "com_google_re2j",
+    "org_apache_commons_validator",
+)
diff --git a/WORKSPACE b/WORKSPACE
index 29e4f9d6f..6e5744726 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -4,11 +4,18 @@ load("//bazel:repositories.bzl", "pgv_dependencies")
 
 pgv_dependencies()
 
+load("@rules_python//python:repositories.bzl", "py_repositories")
+
+py_repositories()
+
 load("//bazel:dependency_imports.bzl", "pgv_dependency_imports")
 
 pgv_dependency_imports()
 
-load("//:dependencies.bzl", "go_third_party")
+load("//bazel:extra_dependency_imports.bzl", "pgv_extra_dependency_imports")
+
+pgv_extra_dependency_imports()
+
+load("@maven//:defs.bzl", "pinned_maven_install")
 
-# gazelle:repository_macro dependencies.bzl%go_third_party
-go_third_party()
+pinned_maven_install()
diff --git a/WORKSPACE.bzlmod b/WORKSPACE.bzlmod
new file mode 100644
index 000000000..e69de29bb
diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
index 65c61dcf1..666edf7a8 100644
--- a/bazel/dependency_imports.bzl
+++ b/bazel/dependency_imports.bzl
@@ -1,15 +1,16 @@
 load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
 load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
-load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
-load("@rules_python//python:pip.bzl", "pip_install")
+load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies")
+load("@rules_proto//proto:toolchains.bzl", "rules_proto_toolchains")
+load("@rules_python//python:pip.bzl", "pip_parse")
 
 def _pgv_pip_dependencies():
     # This rule translates the specified requirements.in (which must be same as install_requires from setup.cfg)
     # into @pgv_pip_deps//:requirements.bzl.
-    pip_install(
+    pip_parse(
         name = "pgv_pip_deps",
-        requirements = "@com_envoyproxy_protoc_gen_validate//python:requirements.in",
+        requirements_lock = "@com_envoyproxy_protoc_gen_validate//python:requirements.txt",
     )
 
 def _pgv_go_dependencies():
diff --git a/bazel/extra_dependency_imports.bzl b/bazel/extra_dependency_imports.bzl
new file mode 100644
index 000000000..b78260665
--- /dev/null
+++ b/bazel/extra_dependency_imports.bzl
@@ -0,0 +1,22 @@
+load("@bazel_features//:deps.bzl", "bazel_features_deps")
+load("@com_google_protobuf//:protobuf_deps.bzl", "PROTOBUF_MAVEN_ARTIFACTS")
+load("@pgv_pip_deps//:requirements.bzl", "install_deps")
+load("@rules_jvm_external//:defs.bzl", "maven_install")
+load("//:dependencies.bzl", "go_third_party")
+
+def pgv_extra_dependency_imports():
+    bazel_features_deps()
+
+    install_deps()
+
+    # gazelle:repository_macro dependencies.bzl%go_third_party
+    go_third_party()
+
+    maven_install(
+        artifacts = PROTOBUF_MAVEN_ARTIFACTS,
+        maven_install_json = "@com_google_protobuf//:maven_install.json",
+        repositories = [
+            "https://repo1.maven.org/maven2",
+            "https://repo.maven.apache.org/maven2",
+        ],
+    )
diff --git a/bazel/protobuf.bzl b/bazel/protobuf.bzl
index 62f0869a0..67557f64d 100644
--- a/bazel/protobuf.bzl
+++ b/bazel/protobuf.bzl
@@ -238,4 +238,5 @@ java_proto_gen_validate = rule(
         "srcjar": "lib%{name}-src.jar",
     },
     implementation = _java_proto_gen_validate_impl,
+    toolchains = ["@bazel_tools//tools/jdk:toolchain_type"],
 )
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 0cdd25a71..1e4a5dc27 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -1,36 +1,57 @@
-load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@bazel_tools//tools/build_defs/repo:jvm.bzl", "jvm_maven_import_external")
 
 _DEFAULT_REPOSITORIES = ["https://repo.maven.apache.org/maven2"]
 
+def _non_module_deps(maven_repos = _DEFAULT_REPOSITORIES):
+    if not native.existing_rule("com_google_re2j"):
+        jvm_maven_import_external(
+            name = "com_google_re2j",
+            artifact = "com.google.re2j:re2j:1.2",
+            artifact_sha256 = "e9dc705fd4c570344b54a7146b2e3a819cdc271a29793f4acc1a93b56a388e59",
+            server_urls = maven_repos,
+        )
+
+    if not native.existing_rule("com_google_guava"):
+        jvm_maven_import_external(
+            name = "com_google_guava",
+            artifact = "com.google.guava:guava:27.0-jre",
+            artifact_sha256 = "63b09db6861011e7fb2481be7790c7fd4b03f0bb884b3de2ecba8823ad19bf3f",
+            server_urls = maven_repos,
+        )
+
+    if not native.existing_rule("org_apache_commons_validator"):
+        jvm_maven_import_external(
+            name = "org_apache_commons_validator",
+            artifact = "commons-validator:commons-validator:1.6",
+            artifact_sha256 = "bd62795d7068a69cbea333f6dbf9c9c1a6ad7521443fb57202a44874f240ba25",
+            server_urls = maven_repos,
+        )
+
 def pgv_dependencies(maven_repos = _DEFAULT_REPOSITORIES):
     if not native.existing_rule("io_bazel_rules_go"):
         http_archive(
             name = "io_bazel_rules_go",
-            sha256 = "91585017debb61982f7054c9688857a2ad1fd823fc3f9cb05048b0025c47d023",
+            sha256 = "33acc4ae0f70502db4b893c9fc1dd7a9bf998c23e7ff2c4517741d4049a976f8",
             urls = [
-                "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.42.0/rules_go-v0.42.0.zip",
-                "https://github.com/bazelbuild/rules_go/releases/download/v0.42.0/rules_go-v0.42.0.zip",
+                "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.48.0/rules_go-v0.48.0.zip",
+                "https://github.com/bazelbuild/rules_go/releases/download/v0.48.0/rules_go-v0.48.0.zip",
             ],
         )
 
     if not native.existing_rule("bazel_gazelle"):
         http_archive(
             name = "bazel_gazelle",
-            sha256 = "d3fa66a39028e97d76f9e2db8f1b0c11c099e8e01bf363a923074784e451f809",
-            urls = [
-                "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.33.0/bazel-gazelle-v0.33.0.tar.gz",
-                "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.33.0/bazel-gazelle-v0.33.0.tar.gz",
-            ],
+            sha256 = "d76bf7a60fd8b050444090dfa2837a4eaf9829e1165618ee35dceca5cbdf58d5",
+            url = "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.37.0/bazel-gazelle-v0.37.0.tar.gz",
         )
 
     if not native.existing_rule("com_google_protobuf"):
         http_archive(
             name = "com_google_protobuf",
-            url = "https://github.com/protocolbuffers/protobuf/archive/v3.15.3.tar.gz",
-            sha256 = "b10bf4e2d1a7586f54e64a5d9e7837e5188fc75ae69e36f215eb01def4f9721b",
-            strip_prefix = "protobuf-3.15.3",
+            url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.0/protobuf-27.0.tar.gz",
+            sha256 = "da288bf1daa6c04d03a9051781caa52aceb9163586bff9aa6cfb12f69b9395aa",
+            strip_prefix = "protobuf-27.0",
         )
 
     # TODO(akonradi): This shouldn't be necessary since the same http_archive block is imported by
@@ -51,22 +72,6 @@ def pgv_dependencies(maven_repos = _DEFAULT_REPOSITORIES):
             urls = ["https://github.com/bazelbuild/bazel-skylib/releases/download/1.4.2/bazel-skylib-1.4.2.tar.gz"],
         )
 
-    if not native.existing_rule("six"):
-        http_archive(
-            name = "six",
-            build_file = "@com_google_protobuf//:third_party/six.BUILD",
-            sha256 = "d16a0141ec1a18405cd4ce8b4613101da75da0e9a7aec5bdd4fa804d0e0eba73",
-            urls = ["https://pypi.python.org/packages/source/s/six/six-1.12.0.tar.gz"],
-        )
-
-    if not native.existing_rule("com_google_re2j"):
-        jvm_maven_import_external(
-            name = "com_google_re2j",
-            artifact = "com.google.re2j:re2j:1.2",
-            artifact_sha256 = "e9dc705fd4c570344b54a7146b2e3a819cdc271a29793f4acc1a93b56a388e59",
-            server_urls = maven_repos,
-        )
-
     if not native.existing_rule("com_googlesource_code_re2"):
         http_archive(
             name = "com_googlesource_code_re2",
@@ -75,68 +80,30 @@ def pgv_dependencies(maven_repos = _DEFAULT_REPOSITORIES):
             urls = ["https://github.com/google/re2/archive/2020-07-06.tar.gz"],
         )
 
-    if not native.existing_rule("com_google_guava"):
-        jvm_maven_import_external(
-            name = "com_google_guava",
-            artifact = "com.google.guava:guava:27.0-jre",
-            artifact_sha256 = "63b09db6861011e7fb2481be7790c7fd4b03f0bb884b3de2ecba8823ad19bf3f",
-            server_urls = maven_repos,
-        )
-
-    if not native.existing_rule("guava"):
-        native.bind(
-            name = "guava",
-            actual = "@com_google_guava//jar",
-        )
-
-    if not native.existing_rule("com_google_gson"):
-        jvm_maven_import_external(
-            name = "com_google_gson",
-            artifact = "com.google.code.gson:gson:2.8.5",
-            artifact_sha256 = "233a0149fc365c9f6edbd683cfe266b19bdc773be98eabdaf6b3c924b48e7d81",
-            server_urls = maven_repos,
-        )
-
-    if not native.existing_rule("gson"):
-        native.bind(
-            name = "gson",
-            actual = "@com_google_gson//jar",
-        )
-
-    if not native.existing_rule("error_prone_annotations_maven"):
-        jvm_maven_import_external(
-            name = "error_prone_annotations_maven",
-            artifact = "com.google.errorprone:error_prone_annotations:2.3.2",
-            artifact_sha256 = "357cd6cfb067c969226c442451502aee13800a24e950fdfde77bcdb4565a668d",
-            server_urls = maven_repos,
-        )
-
-    if not native.existing_rule("error_prone_annotations"):
-        native.bind(
-            name = "error_prone_annotations",
-            actual = "@error_prone_annotations_maven//jar",
-        )
-
-    if not native.existing_rule("org_apache_commons_validator"):
-        jvm_maven_import_external(
-            name = "org_apache_commons_validator",
-            artifact = "commons-validator:commons-validator:1.6",
-            artifact_sha256 = "bd62795d7068a69cbea333f6dbf9c9c1a6ad7521443fb57202a44874f240ba25",
-            server_urls = maven_repos,
-        )
-
     if not native.existing_rule("rules_python"):
         http_archive(
             name = "rules_python",
-            sha256 = "b593d13bb43c94ce94b483c2858e53a9b811f6f10e1e0eedc61073bd90e58d9c",
-            strip_prefix = "rules_python-0.12.0",
-            url = "https://github.com/bazelbuild/rules_python/archive/refs/tags/0.12.0.tar.gz",
+            sha256 = "4912ced70dc1a2a8e4b86cec233b192ca053e82bc72d877b98e126156e8f228d",
+            strip_prefix = "rules_python-0.32.2",
+            url = "https://github.com/bazelbuild/rules_python/releases/download/0.32.2/rules_python-0.32.2.tar.gz",
         )
 
     if not native.existing_rule("rules_proto"):
         http_archive(
             name = "rules_proto",
-            sha256 = "2490dca4f249b8a9a3ab07bd1ba6eca085aaf8e45a734af92aad0c42d9dc7aaf",
-            strip_prefix = "rules_proto-218ffa7dfa5408492dc86c01ee637614f8695c45",
-            urls = ["https://github.com/bazelbuild/rules_proto/archive/218ffa7dfa5408492dc86c01ee637614f8695c45.tar.gz"],
+            sha256 = "303e86e722a520f6f326a50b41cfc16b98fe6d1955ce46642a5b7a67c11c0f5d",
+            strip_prefix = "rules_proto-6.0.0",
+            url = "https://github.com/bazelbuild/rules_proto/releases/download/6.0.0/rules_proto-6.0.0.tar.gz",
         )
+
+    if not native.existing_rule("rules_cc"):
+        http_archive(
+            name = "rules_cc",
+            sha256 = "2037875b9a4456dce4a79d112a8ae885bbc4aad968e6587dca6e64f3a0900cdf",
+            strip_prefix = "rules_cc-0.0.9",
+            url = "https://github.com/bazelbuild/rules_cc/releases/download/0.0.9/rules_cc-0.0.9.tar.gz",
+        )
+
+    _non_module_deps(maven_repos)
+
+non_module_deps = module_extension(implementation = lambda _: _non_module_deps())
diff --git a/example-workspace/.bazelrc b/example-workspace/.bazelrc
deleted file mode 100644
index 36db65165..000000000
--- a/example-workspace/.bazelrc
+++ /dev/null
@@ -1 +0,0 @@
-build --incompatible_use_cc_configure_from_rules_cc
diff --git a/example-workspace/.bazelversion b/example-workspace/.bazelversion
new file mode 120000
index 000000000..b33260497
--- /dev/null
+++ b/example-workspace/.bazelversion
@@ -0,0 +1 @@
+../.bazelversion
\ No newline at end of file
diff --git a/example-workspace/BUILD b/example-workspace/BUILD
index 75ce9c8b2..04fd48d2e 100644
--- a/example-workspace/BUILD
+++ b/example-workspace/BUILD
@@ -1,3 +1,10 @@
+load("@rules_python//python:defs.bzl", "py_binary")
+# Example python binary that uses the dynamic python validation code.
+#
+# Exactly as example_cc above except different label. Example:
+#
+# bazel run //:example_py -- $(pwd)/valid.textproto
+
 # Example C++ binary that uses the generated validation code.
 #
 # This binary attempts to read files named on the command line as binary protos.
@@ -26,37 +33,33 @@ cc_binary(
     deps = ["//foo:bar_cc_proto"],
 )
 
-# Example python binary that uses the dynamic python validation code.
-#
-# Exactly as example_cc above except different label. Example:
-#
-# bazel run //:example_py -- $(pwd)/valid.textproto
-
 py_binary(
     name = "example_py",
     srcs = ["example.py"],
     main = "example.py",
     srcs_version = "PY3",
     deps = [
-        "@com_google_protobuf//:protobuf_python",
-        "@com_envoyproxy_protoc_gen_validate//python:validator_py",
         "//foo:bar_py_proto",
+        "@com_envoyproxy_protoc_gen_validate//python:validator_py",
     ],
 )
 
 # Test that the example textproto inputs evoke the right responses.
 [
     sh_test(
-        name = "example_{lang}_test_{which}".format(lang=lang, which=which),
+        name = "example_{lang}_test_{which}".format(
+            lang = lang,
+            which = which,
+        ),
         srcs = ["example_test.sh"],
         args = [
-            "$(location :example_{lang})".format(lang=lang),
+            "$(location :example_{lang})".format(lang = lang),
             str(code),
-            "$(location :{which})".format(which=which),
+            "$(location :{which})".format(which = which),
         ],
         data = [
             which,
-            ":example_{lang}".format(lang=lang),
+            ":example_{lang}".format(lang = lang),
         ],
     )
     for lang in (
diff --git a/example-workspace/MODULE.bazel b/example-workspace/MODULE.bazel
new file mode 100644
index 000000000..c2abaea55
--- /dev/null
+++ b/example-workspace/MODULE.bazel
@@ -0,0 +1,11 @@
+module(name = "pgv_example")
+
+bazel_dep(name = "protoc-gen-validate", repo_name = "com_envoyproxy_protoc_gen_validate")
+local_path_override(
+    module_name = "protoc-gen-validate",
+    path = "..",
+)
+
+bazel_dep(name = "protobuf", version = "27.0-rc2", repo_name = "com_google_protobuf")
+bazel_dep(name = "rules_python", version = "0.32.2")
+bazel_dep(name = "re2", version = "2021-09-01", repo_name = "com_googlesource_code_re2")
diff --git a/example-workspace/WORKSPACE b/example-workspace/WORKSPACE
index 95d52d705..cfb04f2f7 100644
--- a/example-workspace/WORKSPACE
+++ b/example-workspace/WORKSPACE
@@ -15,12 +15,15 @@ load("@com_envoyproxy_protoc_gen_validate//bazel:repositories.bzl", "pgv_depende
 
 pgv_dependencies()
 
+load("@rules_python//python:repositories.bzl", "py_repositories")
+
+py_repositories()
+
 # Perform any necessary actions to initialize dependencies.
 load("@com_envoyproxy_protoc_gen_validate//bazel:dependency_imports.bzl", "pgv_dependency_imports")
 
 pgv_dependency_imports()
 
-load("@com_envoyproxy_protoc_gen_validate//:dependencies.bzl", "go_third_party")
+load("@com_envoyproxy_protoc_gen_validate//bazel:extra_dependency_imports.bzl", "pgv_extra_dependency_imports")
 
-# gazelle:repository_macro dependencies.bzl%go_third_party
-go_third_party()
+pgv_extra_dependency_imports()
diff --git a/example-workspace/WORKSPACE.bzlmod b/example-workspace/WORKSPACE.bzlmod
new file mode 100644
index 000000000..e69de29bb
diff --git a/example-workspace/example.py b/example-workspace/example.py
index 346c677a8..200afd500 100644
--- a/example-workspace/example.py
+++ b/example-workspace/example.py
@@ -2,7 +2,7 @@
 
 from google.protobuf import text_format
 from foo import bar_pb2
-from com_envoyproxy_protoc_gen_validate.python.protoc_gen_validate import validator
+from protoc_gen_validate import validator
 from typing import List
 
 
diff --git a/example-workspace/foo/BUILD b/example-workspace/foo/BUILD
index 4bcff3250..42fb03e4e 100644
--- a/example-workspace/foo/BUILD
+++ b/example-workspace/foo/BUILD
@@ -1,5 +1,5 @@
 load("@com_envoyproxy_protoc_gen_validate//bazel:pgv_proto_library.bzl", "pgv_cc_proto_library")
-load("@com_google_protobuf//:protobuf.bzl", "py_proto_library")
+load("@rules_python//python:proto.bzl", "py_proto_library")
 
 package(
     default_visibility = ["//visibility:public"],
@@ -35,9 +35,5 @@ cc_test(
 
 py_proto_library(
     name = "bar_py_proto",
-    srcs = ["bar.proto"],
-    deps = [
-        "@com_envoyproxy_protoc_gen_validate//validate:validate_py",
-        "@com_google_protobuf//:protobuf_python",
-    ],
+    deps = ["bar_proto"],
 )
diff --git a/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/BUILD b/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/BUILD
index 2839b30a0..7a49670b7 100644
--- a/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/BUILD
+++ b/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/BUILD
@@ -5,7 +5,7 @@ java_library(
     srcs = glob(["*.java"]),
     visibility = ["//visibility:public"],
     deps = [
-        "//external:guava",
+        "@com_google_guava//jar",
         "@com_google_protobuf//:protobuf_java",
         "@com_google_protobuf//:protobuf_java_util",
         "@com_google_re2j//jar",
diff --git a/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/RequiredValidation.java b/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/RequiredValidation.java
index 3cb7185cd..d673e5b0f 100644
--- a/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/RequiredValidation.java
+++ b/java/pgv-java-stub/src/main/java/io/envoyproxy/pgv/RequiredValidation.java
@@ -1,6 +1,6 @@
 package io.envoyproxy.pgv;
 
-import com.google.protobuf.GeneratedMessageV3;
+import com.google.protobuf.Message;
 
 /**
  * {@code RequiredValidation} implements PGV validation for required fields.
@@ -9,7 +9,7 @@ public final class RequiredValidation {
     private RequiredValidation() {
     }
 
-    public static void required(String field, GeneratedMessageV3 value) throws ValidationException {
+    public static void required(String field, Message value) throws ValidationException {
         if (value == null) {
             throw new ValidationException(field, "null", "is required");
         }
diff --git a/python/BUILD b/python/BUILD
index bf99c5f5d..b62f8b5f7 100644
--- a/python/BUILD
+++ b/python/BUILD
@@ -1,14 +1,22 @@
-load("@rules_python//python:defs.bzl", "py_library")
 load("@pgv_pip_deps//:requirements.bzl", "all_requirements")
+load("@rules_python//python:defs.bzl", "py_library")
+load("@rules_python//python:pip.bzl", "compile_pip_requirements")
 
 exports_files([
+    "requirements.txt",
     "requirements.in",
     "setup.cfg",
 ])
 
+compile_pip_requirements(
+    name = "requirements",
+    src = "requirements.in",
+)
+
 py_library(
     name = "validator_py",
     srcs = glob(["**/*.py"]),
     visibility = ["//visibility:public"],
+    imports = ["."],
     deps = all_requirements,
 )
diff --git a/python/requirements.txt b/python/requirements.txt
new file mode 100644
index 000000000..6af705820
--- /dev/null
+++ b/python/requirements.txt
@@ -0,0 +1,100 @@
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    bazel run //python:requirements.update
+#
+astunparse==1.6.3 \
+    --hash=sha256:5ad93a8456f0d084c3456d059fd9a92cce667963232cbf763eac3bc5b7940872 \
+    --hash=sha256:c2652417f2c8b5bb325c885ae329bdf3f86424075c4fd1a128674bc6fba4b8e8
+    # via -r python/requirements.in
+jinja2==3.1.4 \
+    --hash=sha256:4a3aee7acbbe7303aede8e9648d13b8bf88a429282aa6122a993f0ac800cb369 \
+    --hash=sha256:bc5dd2abb727a5319567b7a813e6a2e7318c39f4f487cfe6c89c6f9c7d25197d
+    # via -r python/requirements.in
+markupsafe==2.1.5 \
+    --hash=sha256:00e046b6dd71aa03a41079792f8473dc494d564611a8f89bbbd7cb93295ebdcf \
+    --hash=sha256:075202fa5b72c86ad32dc7d0b56024ebdbcf2048c0ba09f1cde31bfdd57bcfff \
+    --hash=sha256:0e397ac966fdf721b2c528cf028494e86172b4feba51d65f81ffd65c63798f3f \
+    --hash=sha256:17b950fccb810b3293638215058e432159d2b71005c74371d784862b7e4683f3 \
+    --hash=sha256:1f3fbcb7ef1f16e48246f704ab79d79da8a46891e2da03f8783a5b6fa41a9532 \
+    --hash=sha256:2174c595a0d73a3080ca3257b40096db99799265e1c27cc5a610743acd86d62f \
+    --hash=sha256:2b7c57a4dfc4f16f7142221afe5ba4e093e09e728ca65c51f5620c9aaeb9a617 \
+    --hash=sha256:2d2d793e36e230fd32babe143b04cec8a8b3eb8a3122d2aceb4a371e6b09b8df \
+    --hash=sha256:30b600cf0a7ac9234b2638fbc0fb6158ba5bdcdf46aeb631ead21248b9affbc4 \
+    --hash=sha256:397081c1a0bfb5124355710fe79478cdbeb39626492b15d399526ae53422b906 \
+    --hash=sha256:3a57fdd7ce31c7ff06cdfbf31dafa96cc533c21e443d57f5b1ecc6cdc668ec7f \
+    --hash=sha256:3c6b973f22eb18a789b1460b4b91bf04ae3f0c4234a0a6aa6b0a92f6f7b951d4 \
+    --hash=sha256:3e53af139f8579a6d5f7b76549125f0d94d7e630761a2111bc431fd820e163b8 \
+    --hash=sha256:4096e9de5c6fdf43fb4f04c26fb114f61ef0bf2e5604b6ee3019d51b69e8c371 \
+    --hash=sha256:4275d846e41ecefa46e2015117a9f491e57a71ddd59bbead77e904dc02b1bed2 \
+    --hash=sha256:4c31f53cdae6ecfa91a77820e8b151dba54ab528ba65dfd235c80b086d68a465 \
+    --hash=sha256:4f11aa001c540f62c6166c7726f71f7573b52c68c31f014c25cc7901deea0b52 \
+    --hash=sha256:5049256f536511ee3f7e1b3f87d1d1209d327e818e6ae1365e8653d7e3abb6a6 \
+    --hash=sha256:58c98fee265677f63a4385256a6d7683ab1832f3ddd1e66fe948d5880c21a169 \
+    --hash=sha256:598e3276b64aff0e7b3451b72e94fa3c238d452e7ddcd893c3ab324717456bad \
+    --hash=sha256:5b7b716f97b52c5a14bffdf688f971b2d5ef4029127f1ad7a513973cfd818df2 \
+    --hash=sha256:5dedb4db619ba5a2787a94d877bc8ffc0566f92a01c0ef214865e54ecc9ee5e0 \
+    --hash=sha256:619bc166c4f2de5caa5a633b8b7326fbe98e0ccbfacabd87268a2b15ff73a029 \
+    --hash=sha256:629ddd2ca402ae6dbedfceeba9c46d5f7b2a61d9749597d4307f943ef198fc1f \
+    --hash=sha256:656f7526c69fac7f600bd1f400991cc282b417d17539a1b228617081106feb4a \
+    --hash=sha256:6ec585f69cec0aa07d945b20805be741395e28ac1627333b1c5b0105962ffced \
+    --hash=sha256:72b6be590cc35924b02c78ef34b467da4ba07e4e0f0454a2c5907f473fc50ce5 \
+    --hash=sha256:7502934a33b54030eaf1194c21c692a534196063db72176b0c4028e140f8f32c \
+    --hash=sha256:7a68b554d356a91cce1236aa7682dc01df0edba8d043fd1ce607c49dd3c1edcf \
+    --hash=sha256:7b2e5a267c855eea6b4283940daa6e88a285f5f2a67f2220203786dfa59b37e9 \
+    --hash=sha256:823b65d8706e32ad2df51ed89496147a42a2a6e01c13cfb6ffb8b1e92bc910bb \
+    --hash=sha256:8590b4ae07a35970728874632fed7bd57b26b0102df2d2b233b6d9d82f6c62ad \
+    --hash=sha256:8dd717634f5a044f860435c1d8c16a270ddf0ef8588d4887037c5028b859b0c3 \
+    --hash=sha256:8dec4936e9c3100156f8a2dc89c4b88d5c435175ff03413b443469c7c8c5f4d1 \
+    --hash=sha256:97cafb1f3cbcd3fd2b6fbfb99ae11cdb14deea0736fc2b0952ee177f2b813a46 \
+    --hash=sha256:a17a92de5231666cfbe003f0e4b9b3a7ae3afb1ec2845aadc2bacc93ff85febc \
+    --hash=sha256:a549b9c31bec33820e885335b451286e2969a2d9e24879f83fe904a5ce59d70a \
+    --hash=sha256:ac07bad82163452a6884fe8fa0963fb98c2346ba78d779ec06bd7a6262132aee \
+    --hash=sha256:ae2ad8ae6ebee9d2d94b17fb62763125f3f374c25618198f40cbb8b525411900 \
+    --hash=sha256:b91c037585eba9095565a3556f611e3cbfaa42ca1e865f7b8015fe5c7336d5a5 \
+    --hash=sha256:bc1667f8b83f48511b94671e0e441401371dfd0f0a795c7daa4a3cd1dde55bea \
+    --hash=sha256:bec0a414d016ac1a18862a519e54b2fd0fc8bbfd6890376898a6c0891dd82e9f \
+    --hash=sha256:bf50cd79a75d181c9181df03572cdce0fbb75cc353bc350712073108cba98de5 \
+    --hash=sha256:bff1b4290a66b490a2f4719358c0cdcd9bafb6b8f061e45c7a2460866bf50c2e \
+    --hash=sha256:c061bb86a71b42465156a3ee7bd58c8c2ceacdbeb95d05a99893e08b8467359a \
+    --hash=sha256:c8b29db45f8fe46ad280a7294f5c3ec36dbac9491f2d1c17345be8e69cc5928f \
+    --hash=sha256:ce409136744f6521e39fd8e2a24c53fa18ad67aa5bc7c2cf83645cce5b5c4e50 \
+    --hash=sha256:d050b3361367a06d752db6ead6e7edeb0009be66bc3bae0ee9d97fb326badc2a \
+    --hash=sha256:d283d37a890ba4c1ae73ffadf8046435c76e7bc2247bbb63c00bd1a709c6544b \
+    --hash=sha256:d9fad5155d72433c921b782e58892377c44bd6252b5af2f67f16b194987338a4 \
+    --hash=sha256:daa4ee5a243f0f20d528d939d06670a298dd39b1ad5f8a72a4275124a7819eff \
+    --hash=sha256:db0b55e0f3cc0be60c1f19efdde9a637c32740486004f20d1cff53c3c0ece4d2 \
+    --hash=sha256:e61659ba32cf2cf1481e575d0462554625196a1f2fc06a1c777d3f48e8865d46 \
+    --hash=sha256:ea3d8a3d18833cf4304cd2fc9cbb1efe188ca9b5efef2bdac7adc20594a0e46b \
+    --hash=sha256:ec6a563cff360b50eed26f13adc43e61bc0c04d94b8be985e6fb24b81f6dcfdf \
+    --hash=sha256:f5dfb42c4604dddc8e4305050aa6deb084540643ed5804d7455b5df8fe16f5e5 \
+    --hash=sha256:fa173ec60341d6bb97a89f5ea19c85c5643c1e7dedebc22f5181eb73573142c5 \
+    --hash=sha256:fa9db3f79de01457b03d4f01b34cf91bc0048eb2c3846ff26f66687c2f6d16ab \
+    --hash=sha256:fce659a462a1be54d2ffcacea5e3ba2d74daa74f30f5f143fe0c58636e355fdd \
+    --hash=sha256:ffee1f21e5ef0d712f9033568f8344d5da8cc2869dbd08d87c84656e6a2d2f68
+    # via jinja2
+protobuf==5.27.0 \
+    --hash=sha256:07f2b9a15255e3cf3f137d884af7972407b556a7a220912b252f26dc3121e6bf \
+    --hash=sha256:2f83bf341d925650d550b8932b71763321d782529ac0eaf278f5242f513cc04e \
+    --hash=sha256:56937f97ae0dcf4e220ff2abb1456c51a334144c9960b23597f044ce99c29c89 \
+    --hash=sha256:587be23f1212da7a14a6c65fd61995f8ef35779d4aea9e36aad81f5f3b80aec5 \
+    --hash=sha256:673ad60f1536b394b4fa0bcd3146a4130fcad85bfe3b60eaa86d6a0ace0fa374 \
+    --hash=sha256:744489f77c29174328d32f8921566fb0f7080a2f064c5137b9d6f4b790f9e0c1 \
+    --hash=sha256:7cb65fc8fba680b27cf7a07678084c6e68ee13cab7cace734954c25a43da6d0f \
+    --hash=sha256:a17f4d664ea868102feaa30a674542255f9f4bf835d943d588440d1f49a3ed15 \
+    --hash=sha256:aabbbcf794fbb4c692ff14ce06780a66d04758435717107c387f12fb477bf0d8 \
+    --hash=sha256:b276e3f477ea1eebff3c2e1515136cfcff5ac14519c45f9b4aa2f6a87ea627c4 \
+    --hash=sha256:f51f33d305e18646f03acfdb343aac15b8115235af98bc9f844bf9446573827b
+    # via -r python/requirements.in
+six==1.16.0 \
+    --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
+    --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
+    # via astunparse
+validate-email==1.3 \
+    --hash=sha256:784719dc5f780be319cdd185dc85dd93afebdb6ebb943811bc4c7c5f9c72aeaf
+    # via -r python/requirements.in
+wheel==0.43.0 \
+    --hash=sha256:465ef92c69fa5c5da2d1cf8ac40559a8c940886afcef87dcf14b9470862f1d85 \
+    --hash=sha256:55c570405f142630c6b9f72fe09d9b67cf1477fcf543ae5b8dcb1f5b7377da81
+    # via astunparse
diff --git a/tests/harness/BUILD b/tests/harness/BUILD
index c5dfc5637..f206df7b4 100644
--- a/tests/harness/BUILD
+++ b/tests/harness/BUILD
@@ -1,9 +1,9 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 load("@rules_cc//cc:defs.bzl", "cc_proto_library")
 load("@rules_java//java:defs.bzl", "java_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
-load("@com_google_protobuf//:protobuf.bzl", "py_proto_library")
-load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_python//python:proto.bzl", "py_proto_library")
 
 proto_library(
     name = "harness_proto",
@@ -44,7 +44,6 @@ go_library(
 
 py_proto_library(
     name = "harness_py_proto",
-    srcs = ["harness.proto"],
     visibility = ["//visibility:public"],
-    deps = ["@com_google_protobuf//:protobuf_python"],
+    deps = [":harness_proto"],
 )
diff --git a/tests/harness/cases/BUILD b/tests/harness/cases/BUILD
index 2d7529dfc..adb0ec86f 100644
--- a/tests/harness/cases/BUILD
+++ b/tests/harness/cases/BUILD
@@ -1,6 +1,6 @@
 load("@rules_java//java:defs.bzl", "java_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
-load("@com_google_protobuf//:protobuf.bzl", "py_proto_library")
+load("@rules_python//python:proto.bzl", "py_proto_library")
 load(
     "//bazel:pgv_proto_library.bzl",
     "pgv_cc_proto_library",
@@ -34,8 +34,8 @@ proto_library(
     visibility = ["//visibility:public"],
     deps = [
         "//tests/harness/cases/other_package:embed_proto",
-        "//tests/harness/cases/yet_another_package:embed_proto",
         "//tests/harness/cases/sort:sort_proto",
+        "//tests/harness/cases/yet_another_package:embed_proto",
         "//validate:validate_proto",
         "@com_google_protobuf//:any_proto",
         "@com_google_protobuf//:duration_proto",
@@ -50,8 +50,8 @@ pgv_go_proto_library(
     proto = ":cases_proto",
     deps = [
         "//tests/harness/cases/other_package:go",
-        "//tests/harness/cases/yet_another_package:go",
         "//tests/harness/cases/sort:go",
+        "//tests/harness/cases/yet_another_package:go",
         "@org_golang_google_protobuf//types/known/anypb:go_default_library",
         "@org_golang_google_protobuf//types/known/durationpb:go_default_library",
         "@org_golang_google_protobuf//types/known/timestamppb:go_default_library",
@@ -63,8 +63,8 @@ pgv_cc_proto_library(
     name = "cc",
     cc_deps = [
         "//tests/harness/cases/other_package:cc",
-        "//tests/harness/cases/yet_another_package:cc",
         "//tests/harness/cases/sort:cc",
+        "//tests/harness/cases/yet_another_package:cc",
     ],
     visibility = ["//tests:__subpackages__"],
     deps = [":cases_proto"],
@@ -88,34 +88,8 @@ pgv_java_proto_library(
     deps = [":cases_proto"],
 )
 
-# There is not currently a canonical implementation of py_proto_library in Bazel.
-# This py_proto_library implementation is from "github.com/protocolbuffers/protobuf" and works differently from other
-# languages' canonical implementations - for example, it doesn't take "proto_library" targets as input.
 py_proto_library(
     name = "cases_py_proto",
-    srcs = [
-        "bool.proto",
-        "bytes.proto",
-        "enums.proto",
-        "kitchen_sink.proto",
-        "maps.proto",
-        "messages.proto",
-        "numbers.proto",
-        "oneofs.proto",
-        "repeated.proto",
-        "strings.proto",
-        "wkt_any.proto",
-        "wkt_duration.proto",
-        "wkt_nested.proto",
-        "wkt_timestamp.proto",
-        "wkt_wrappers.proto",
-    ],
     visibility = ["//visibility:public"],
-    deps = [
-        "//validate:validate_py",
-        "//tests/harness/cases/other_package:embed_python_proto",
-        "//tests/harness/cases/yet_another_package:embed_python_proto",
-        "//tests/harness/cases/sort:sort_python_proto",
-        "@com_google_protobuf//:protobuf_python",
-    ],
+    deps = [":cases_proto"],
 )
diff --git a/tests/harness/cases/other_package/BUILD b/tests/harness/cases/other_package/BUILD
index 215c07472..ed14ab064 100644
--- a/tests/harness/cases/other_package/BUILD
+++ b/tests/harness/cases/other_package/BUILD
@@ -1,8 +1,8 @@
-load("@rules_java//java:defs.bzl", "java_proto_library")
-load("@com_google_protobuf//:protobuf.bzl", "py_proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_java//java:defs.bzl", "java_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@rules_python//python:proto.bzl", "py_proto_library")
 load(
     "//bazel:pgv_proto_library.bzl",
     "pgv_cc_proto_library",
@@ -71,10 +71,6 @@ pgv_java_proto_library(
 
 py_proto_library(
     name = "embed_python_proto",
-    srcs = ["embed.proto"],
+    deps = [":embed_proto"],
     visibility = ["//visibility:public"],
-    deps = [
-        "//validate:validate_py",
-        "@com_google_protobuf//:protobuf_python",
-    ],
 )
diff --git a/tests/harness/cases/sort/BUILD b/tests/harness/cases/sort/BUILD
index b2a1b75f9..1077297b9 100644
--- a/tests/harness/cases/sort/BUILD
+++ b/tests/harness/cases/sort/BUILD
@@ -1,8 +1,8 @@
-load("@rules_java//java:defs.bzl", "java_proto_library")
-load("@com_google_protobuf//:protobuf.bzl", "py_proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_java//java:defs.bzl", "java_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@rules_python//python:proto.bzl", "py_proto_library")
 load(
     "//bazel:pgv_proto_library.bzl",
     "pgv_cc_proto_library",
@@ -71,10 +71,6 @@ pgv_java_proto_library(
 
 py_proto_library(
     name = "sort_python_proto",
-    srcs = ["sort.proto"],
+    deps = [":sort_proto"],
     visibility = ["//visibility:public"],
-    deps = [
-        "//validate:validate_py",
-        "@com_google_protobuf//:protobuf_python",
-    ],
 )
diff --git a/tests/harness/cases/yet_another_package/BUILD b/tests/harness/cases/yet_another_package/BUILD
index 5365c0e05..5518b6a55 100644
--- a/tests/harness/cases/yet_another_package/BUILD
+++ b/tests/harness/cases/yet_another_package/BUILD
@@ -1,8 +1,8 @@
-load("@rules_java//java:defs.bzl", "java_proto_library")
-load("@com_google_protobuf//:protobuf.bzl", "py_proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_java//java:defs.bzl", "java_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@rules_python//python:proto.bzl", "py_proto_library")
 load(
     "//bazel:pgv_proto_library.bzl",
     "pgv_cc_proto_library",
@@ -71,10 +71,6 @@ pgv_java_proto_library(
 
 py_proto_library(
     name = "embed_python_proto",
-    srcs = ["embed.proto"],
+    deps = [":embed_proto"],
     visibility = ["//visibility:public"],
-    deps = [
-        "//validate:validate_py",
-        "@com_google_protobuf//:protobuf_python",
-    ],
 )
diff --git a/validate/BUILD b/validate/BUILD
index a9d38c51b..7d40181e9 100644
--- a/validate/BUILD
+++ b/validate/BUILD
@@ -1,9 +1,9 @@
-load("@com_google_protobuf//:protobuf.bzl", "py_proto_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 load("@rules_cc//cc:defs.bzl", "cc_library", "cc_proto_library")
 load("@rules_java//java:defs.bzl", "java_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@rules_python//python:proto.bzl", "py_proto_library")
 
 package(
     default_visibility =
@@ -27,8 +27,7 @@ cc_proto_library(
 
 py_proto_library(
     name = "validate_py",
-    srcs = ["validate.proto"],
-    deps = ["@com_google_protobuf//:protobuf_python"],
+    deps = [":validate_proto"],
 )
 
 go_proto_library(