diff --git a/BUILD.bazel b/BUILD.bazel
index e413c89..b5111ee 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -1,5 +1,11 @@
-load("@bazel_gazelle//:def.bzl", "gazelle")
+load("@bazel_gazelle//:def.bzl", "gazelle", "gazelle_test")
 load("@bazeldnf//:def.bzl", "bazeldnf")
+load("@buildifier_prebuilt//:rules.bzl", "buildifier", "buildifier_test")
+load("@rules_multirun//:defs.bzl", "command", "multirun")
+
+exports_files([
+    "MODULE.bazel",
+])
 
 # gazelle:prefix source.monogon.dev
 # gazelle:go_naming_convention import
@@ -7,6 +13,40 @@
 # gazelle:exclude .bazeldnf/**
 gazelle(name = "gazelle")
 
+gazelle_test(
+    name = "gazelle_test",
+    workspace = "//:MODULE.bazel",
+)
+
+BUILDIFIER_EXCLUDES = [
+    "./.git/*",
+    "./.ijwb/*",
+]
+
+# Buildifier formats all Starlark files.
+buildifier(
+    name = "buildifier",
+    exclude_patterns = BUILDIFIER_EXCLUDES,
+    lint_mode = "fix",
+    mode = "fix",
+)
+
+buildifier_test(
+    name = "buildifier_test",
+    exclude_patterns = BUILDIFIER_EXCLUDES,
+    lint_mode = "warn",
+    lint_warnings = [
+        "-module-docstring",
+        "-function-docstring-args",
+        "-function-docstring",
+        "-function-docstring-header",
+        "-function-docstring-return",
+        "-unnamed-macro",  #TODO(tim): Update code to pass this
+    ],
+    no_sandbox = True,
+    workspace = "//:MODULE.bazel",
+)
+
 # Shortcut for the Go SDK
 alias(
     name = "go",
@@ -38,3 +78,22 @@
     actual = "@org_golang_x_tools//cmd/goimports:goimports",
     visibility = ["//visibility:public"],
 )
+
+command(
+    name = "go-mod-tidy",
+    arguments = [
+        "mod",
+        "tidy",
+    ],
+    command = ":go",
+)
+
+# Shortcut to update go.mod, gazelle files and formatting.
+multirun(
+    name = "tidy",
+    commands = [
+        ":go-mod-tidy",
+        ":gazelle",
+        ":buildifier",
+    ],
+)
diff --git a/MODULE.bazel b/MODULE.bazel
index 8e26bfc..17d6428 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -57,6 +57,7 @@
     version = "1.3.1",
 )
 
+bazel_dep(name = "buildifier_prebuilt", version = "7.3.1")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "rules_oci", version = "2.2.0")
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 08b5fef..66c33b4 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -49,6 +49,8 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.0/MODULE.bazel": "0db596f4563de7938de764cc8deeabec291f55e8ec15299718b93c4423e9796d",
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.1/MODULE.bazel": "3120d80c5861aa616222ec015332e5f8d3171e062e3e804a2a0253e1be26e59b",
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.1/source.json": "f121b43eeefc7c29efbd51b83d08631e2347297c95aac9764a701f2a6a2bb953",
+    "https://bcr.bazel.build/modules/buildifier_prebuilt/7.3.1/MODULE.bazel": "537faf0ad9f5892910074b8e43b4c91c96f1d5d86b6ed04bdbe40cf68aa48b68",
+    "https://bcr.bazel.build/modules/buildifier_prebuilt/7.3.1/source.json": "55153a5e6ca9c8a7e266c4b46b951e8a010d25ec6062bc35d5d4f89925796bad",
     "https://bcr.bazel.build/modules/buildozer/7.1.2/MODULE.bazel": "2e8dd40ede9c454042645fd8d8d0cd1527966aa5c919de86661e62953cd73d84",
     "https://bcr.bazel.build/modules/buildozer/7.1.2/source.json": "c9028a501d2db85793a6996205c8de120944f50a0d570438fcae0457a5f9d1f8",
     "https://bcr.bazel.build/modules/gazelle/0.41.0/MODULE.bazel": "fdce8a8f5129d5b6d693d91cb191d0a014fdcb88e9094e528325a7165de2a826",
@@ -307,6 +309,156 @@
         ]
       }
     },
+    "@@buildifier_prebuilt~//:defs.bzl%buildifier_prebuilt_deps_extension": {
+      "general": {
+        "bzlTransitiveDigest": "lqH5eQXGrxGyrPzoegk5Mn6zC3A1P0h+QsA1O/QlXHc=",
+        "usagesDigest": "yt+GfSH6jiwv+nPT5fzdhb/zB+8RgR4U+dna3WGxrzU=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "buildifier_darwin_amd64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-darwin-amd64"
+              ],
+              "downloaded_file_path": "buildifier",
+              "executable": true,
+              "sha256": "375f823103d01620aaec20a0c29c6cbca99f4fd0725ae30b93655c6704f44d71"
+            }
+          },
+          "buildifier_darwin_arm64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-darwin-arm64"
+              ],
+              "downloaded_file_path": "buildifier",
+              "executable": true,
+              "sha256": "5a6afc6ac7a09f5455ba0b89bd99d5ae23b4174dc5dc9d6c0ed5ce8caac3f813"
+            }
+          },
+          "buildifier_linux_amd64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-amd64"
+              ],
+              "downloaded_file_path": "buildifier",
+              "executable": true,
+              "sha256": "5474cc5128a74e806783d54081f581662c4be8ae65022f557e9281ed5dc88009"
+            }
+          },
+          "buildifier_linux_arm64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-arm64"
+              ],
+              "downloaded_file_path": "buildifier",
+              "executable": true,
+              "sha256": "0bf86c4bfffaf4f08eed77bde5b2082e4ae5039a11e2e8b03984c173c34a561c"
+            }
+          },
+          "buildifier_windows_amd64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-windows-amd64.exe"
+              ],
+              "downloaded_file_path": "buildifier.exe",
+              "executable": true,
+              "sha256": "370cd576075ad29930a82f5de132f1a1de4084c784a82514bd4da80c85acf4a8"
+            }
+          },
+          "buildozer_darwin_amd64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-darwin-amd64"
+              ],
+              "downloaded_file_path": "buildozer",
+              "executable": true,
+              "sha256": "854c9583efc166602276802658cef3f224d60898cfaa60630b33d328db3b0de2"
+            }
+          },
+          "buildozer_darwin_arm64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-darwin-arm64"
+              ],
+              "downloaded_file_path": "buildozer",
+              "executable": true,
+              "sha256": "31b1bfe20d7d5444be217af78f94c5c43799cdf847c6ce69794b7bf3319c5364"
+            }
+          },
+          "buildozer_linux_amd64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-linux-amd64"
+              ],
+              "downloaded_file_path": "buildozer",
+              "executable": true,
+              "sha256": "3305e287b3fcc68b9a35fd8515ee617452cd4e018f9e6886b6c7cdbcba8710d4"
+            }
+          },
+          "buildozer_linux_arm64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-linux-arm64"
+              ],
+              "downloaded_file_path": "buildozer",
+              "executable": true,
+              "sha256": "0b5a2a717ac4fc911e1fec8d92af71dbb4fe95b10e5213da0cc3d56cea64a328"
+            }
+          },
+          "buildozer_windows_amd64": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_file",
+            "attributes": {
+              "urls": [
+                "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-windows-amd64.exe"
+              ],
+              "downloaded_file_path": "buildozer.exe",
+              "executable": true,
+              "sha256": "58d41ce53257c5594c9bc86d769f580909269f68de114297f46284fbb9023dcf"
+            }
+          },
+          "buildifier_prebuilt_toolchains": {
+            "bzlFile": "@@buildifier_prebuilt~//:defs.bzl",
+            "ruleClassName": "_buildifier_toolchain_setup",
+            "attributes": {
+              "assets_json": "[{\"arch\":\"amd64\",\"name\":\"buildifier\",\"platform\":\"darwin\",\"sha256\":\"375f823103d01620aaec20a0c29c6cbca99f4fd0725ae30b93655c6704f44d71\",\"version\":\"v7.3.1\"},{\"arch\":\"arm64\",\"name\":\"buildifier\",\"platform\":\"darwin\",\"sha256\":\"5a6afc6ac7a09f5455ba0b89bd99d5ae23b4174dc5dc9d6c0ed5ce8caac3f813\",\"version\":\"v7.3.1\"},{\"arch\":\"amd64\",\"name\":\"buildifier\",\"platform\":\"linux\",\"sha256\":\"5474cc5128a74e806783d54081f581662c4be8ae65022f557e9281ed5dc88009\",\"version\":\"v7.3.1\"},{\"arch\":\"arm64\",\"name\":\"buildifier\",\"platform\":\"linux\",\"sha256\":\"0bf86c4bfffaf4f08eed77bde5b2082e4ae5039a11e2e8b03984c173c34a561c\",\"version\":\"v7.3.1\"},{\"arch\":\"amd64\",\"name\":\"buildifier\",\"platform\":\"windows\",\"sha256\":\"370cd576075ad29930a82f5de132f1a1de4084c784a82514bd4da80c85acf4a8\",\"version\":\"v7.3.1\"},{\"arch\":\"amd64\",\"name\":\"buildozer\",\"platform\":\"darwin\",\"sha256\":\"854c9583efc166602276802658cef3f224d60898cfaa60630b33d328db3b0de2\",\"version\":\"v7.3.1\"},{\"arch\":\"arm64\",\"name\":\"buildozer\",\"platform\":\"darwin\",\"sha256\":\"31b1bfe20d7d5444be217af78f94c5c43799cdf847c6ce69794b7bf3319c5364\",\"version\":\"v7.3.1\"},{\"arch\":\"amd64\",\"name\":\"buildozer\",\"platform\":\"linux\",\"sha256\":\"3305e287b3fcc68b9a35fd8515ee617452cd4e018f9e6886b6c7cdbcba8710d4\",\"version\":\"v7.3.1\"},{\"arch\":\"arm64\",\"name\":\"buildozer\",\"platform\":\"linux\",\"sha256\":\"0b5a2a717ac4fc911e1fec8d92af71dbb4fe95b10e5213da0cc3d56cea64a328\",\"version\":\"v7.3.1\"},{\"arch\":\"amd64\",\"name\":\"buildozer\",\"platform\":\"windows\",\"sha256\":\"58d41ce53257c5594c9bc86d769f580909269f68de114297f46284fbb9023dcf\",\"version\":\"v7.3.1\"}]"
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "buildifier_prebuilt~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "buildifier_prebuilt~",
+            "bazel_tools",
+            "bazel_tools"
+          ]
+        ]
+      }
+    },
     "@@platforms//host:extension.bzl%host_platform": {
       "general": {
         "bzlTransitiveDigest": "xelQcPZH8+tmuOHVjL9vDxMnnQNMlwj0SlvgoqBkm4U=",
diff --git a/build/analysis/BUILD.bazel b/build/analysis/BUILD.bazel
index 8110f9e..930ba25 100644
--- a/build/analysis/BUILD.bazel
+++ b/build/analysis/BUILD.bazel
@@ -1,6 +1,5 @@
-load("@com_github_sluongng_nogo_analyzer//staticcheck:def.bzl", ALL_STATICCHECK_ANALYZERS = "ANALYZERS", format_staticcheck_analyzers = "staticcheck_analyzers")
-load("@com_github_sluongng_nogo_analyzer//:def.bzl", gen_nogo_config = "nogo_config")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
+load("@com_github_sluongng_nogo_analyzer//staticcheck:def.bzl", ALL_STATICCHECK_ANALYZERS = "ANALYZERS", format_staticcheck_analyzers = "staticcheck_analyzers")
 load("@io_bazel_rules_go//go:def.bzl", "nogo")
 
 # NOGO_PASSES contains all enabled analyzers that nogo should execute.
@@ -94,9 +93,9 @@
     "//build/analysis/importsort",
 ]
 
-# NOGO_CONFIG contains the overrides for nogo to exempt specific files
+# NOGO_CONFIG_OVERRIDES contains the overrides for nogo to exempt specific files
 # from being analyzed.
-NOGO_CONFIG = {
+NOGO_CONFIG_OVERRIDES = {
     "shift": {
         "exclude_files": {
             "external/dev_gvisor_gvisor": "third_party",
@@ -218,7 +217,7 @@
 # We override the variable with itself unioned with the other
 # config part, as the Intellij integration doesn't understand
 # the |= expression which makes editing this file kinda annoying.
-NOGO_CONFIG = NOGO_CONFIG | {
+NOGO_CONFIG_EXTERNAL = {
     analyzer: {
         "exclude_files": {
             # Don't run linters on external dependencies
@@ -230,6 +229,8 @@
     for analyzer in DISABLED_FOR_EXTERNAL_CODE
 }
 
+NOGO_CONFIG = NOGO_CONFIG_OVERRIDES | NOGO_CONFIG_EXTERNAL
+
 write_file(
     name = "nogo_config",
     out = "nogo_config.json",
diff --git a/build/bazel_cc_fix/ccfixspec/BUILD.bazel b/build/bazel_cc_fix/ccfixspec/BUILD.bazel
index b24f3f3..0318e17 100644
--- a/build/bazel_cc_fix/ccfixspec/BUILD.bazel
+++ b/build/bazel_cc_fix/ccfixspec/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "build_bazel_cc_fix_ccfixspec_proto",
diff --git a/build/bindata/bindata.bzl b/build/bindata/bindata.bzl
index 5903754..a10b543 100644
--- a/build/bindata/bindata.bzl
+++ b/build/bindata/bindata.bzl
@@ -14,12 +14,9 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@bazel_gazelle//:deps.bzl", "go_repository")
 load(
     "@io_bazel_rules_go//go:def.bzl",
-    "GoLibrary",
     "go_context",
-    "go_library",
 )
 
 def _bindata_impl(ctx):
@@ -65,10 +62,10 @@
         "srcs": attr.label_list(
             mandatory = True,
             allow_files = True,
-         ),
+        ),
         "package": attr.string(
             mandatory = True,
-         ),
+        ),
         "bindata": attr.label(
             allow_single_file = True,
             default = Label("@com_github_kevinburke_go_bindata//go-bindata"),
diff --git a/build/ci/jenkins-presubmit.groovy b/build/ci/jenkins-presubmit.groovy
index 861e967..c658133 100644
--- a/build/ci/jenkins-presubmit.groovy
+++ b/build/ci/jenkins-presubmit.groovy
@@ -51,8 +51,7 @@
                         echo "Gerrit change: ${GERRIT_CHANGE_URL}"
                         sh "git clean -fdx -e '/bazel-*'"
                         sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci mod tidy --lockfile_mode=update"
-                        sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci run //:go -- mod tidy"
-                        sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci run //:gazelle -- update"
+                        sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci run //:tidy"
                     }
                     post {
                         always {
@@ -65,8 +64,7 @@
                                         Please run:
 
                                         \$ bazel mod tidy --lockfile_mode=update
-                                        \$ bazel run //:go -- mod tidy
-                                        \$ bazel run //:gazelle -- update
+                                        \$ bazel run //:tidy
 
                                         In your git checkout and amend the resulting diff to this changelist.
                                     """
diff --git a/build/mirror_proxy/BUILD.bazel b/build/mirror_proxy/BUILD.bazel
index f3c7778..0cafbbc 100644
--- a/build/mirror_proxy/BUILD.bazel
+++ b/build/mirror_proxy/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "mirror_proxy_lib",
@@ -17,15 +19,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "mirror_proxy_layer",
     srcs = [":mirror_proxy"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "mirror_proxy_image",
     base = "@distroless_base",
@@ -35,8 +33,6 @@
     workdir = "/app",
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_push")
-
 oci_push(
     name = "mirror_proxy_push",
     image = ":mirror_proxy_image",
diff --git a/build/sqlc/sqlc.bzl b/build/sqlc/sqlc.bzl
index 034a04f..cfaa3b1 100644
--- a/build/sqlc/sqlc.bzl
+++ b/build/sqlc/sqlc.bzl
@@ -14,37 +14,37 @@
     for file in files:
         if not file.basename.endswith(".up.sql") and not file.basename.endswith(".down.sql"):
             fail("migration %s must end woth .{up,down}.sql" % file.basename)
-        if len(file.basename.split('.')) != 3:
+        if len(file.basename.split(".")) != 3:
             fail("migration %s must not contain any . other than in .{up,down}.sql extension" % file.basename)
-        first = file.basename.split('.')[0]
-        if len(first.split('_')) < 2:
+        first = file.basename.split(".")[0]
+        if len(first.split("_")) < 2:
             fail("migration %s must be in <timestamp>_<name>.{up,down}.sql format" % file.basename)
-        timestamp = first.split('_')[0]
+        timestamp = first.split("_")[0]
         if not timestamp.isdigit():
             fail("migration %s must be in <timestamp>_<name>.{up,down}.sql format" % file.basename)
         timestamp = int(timestamp)
         if timestamp < 1662136250:
             fail("migration %s must be in <timestamp>_<name>.{up,down}.sql format" % file.basename)
 
-        if file.basename.endswith('.up.sql'):
+        if file.basename.endswith(".up.sql"):
             if timestamp in uppers:
-               fail("migration %s conflicts with %s" % [file.basename, uppers[timestamp].basename])
+                fail("migration %s conflicts with %s" % [file.basename, uppers[timestamp].basename])
             uppers[timestamp] = file
-        if file.basename.endswith('.down.sql'):
+        if file.basename.endswith(".down.sql"):
             if timestamp in downers:
-               fail("migration %s conflicts with %s" % [file.basename, downers[timestamp].basename])
+                fail("migration %s conflicts with %s" % [file.basename, downers[timestamp].basename])
             downers[timestamp] = file
 
     # Check each 'up' has a corresponding 'down', and vice-versa.
     for timestamp, up in uppers.items():
         if timestamp not in downers:
             fail("%s has no corresponding 'down' migration" % up.basename)
-        if downers[timestamp].basename.replace('down.sql', 'up.sql') != up.basename:
+        if downers[timestamp].basename.replace("down.sql", "up.sql") != up.basename:
             fail("%s has no corresponding 'down' migration" % up.basename)
     for timestamp, down in downers.items():
         if timestamp not in uppers:
             fail("%s has no corresponding 'up' migration" % down.basename)
-        if uppers[timestamp].basename.replace('up.sql', 'down.sql') != down.basename:
+        if uppers[timestamp].basename.replace("up.sql", "down.sql") != down.basename:
             fail("%s has no corresponding 'up' migration" % down.basename)
 
     return uppers, downers
@@ -57,7 +57,7 @@
 
     # Split migrations into 'up' and 'down'. Only pass 'up' to sqlc. Use both
     # to generate golang-migrate compatible bindata.
-    uppers, downers = _parse_migrations(ctx.files.migrations)
+    uppers, _ = _parse_migrations(ctx.files.migrations)
 
     # Make sure given queries have no repeating basenames. This ensures clean
     # mapping source SQL file name and generated Go file.
@@ -73,6 +73,7 @@
         ctx.actions.declare_file("db.go"),
         ctx.actions.declare_file("models.go"),
     ]
+
     # For every query file, basename.go is also generated.
     for basename in query_basenames:
         sqlc_go_sources.append(ctx.actions.declare_file(basename + ".go"))
@@ -83,15 +84,16 @@
     if ctx.attr.dialect == "cockroachdb":
         overrides = [
             # INT is 64-bit in cockroachdb (32-bit in postgres).
-            { "go_type": "int64", "db_type": "pg_catalog.int4" },
+            {"go_type": "int64", "db_type": "pg_catalog.int4"},
         ]
 
     config = ctx.actions.declare_file("_config.yaml")
+
     # All paths in config are relative to the config file. However, Bazel paths
     # are relative to the execution root/CWD. To make things work regardless of
     # config file placement, we prepend all config paths with a `../../ ...`
     # path walk that makes the path be execroot relative again.
-    config_walk = '../' * config.path.count('/')
+    config_walk = "../" * config.path.count("/")
     config_data = json.encode({
         "version": 2,
         "sql": [
@@ -117,10 +119,11 @@
         executable = ctx.executable._sqlc,
         arguments = [
             "generate",
-            "-f", config.path,
+            "-f",
+            config.path,
         ],
         inputs = [
-            config
+            config,
         ] + uppers.values() + ctx.files.queries,
         outputs = sqlc_go_sources,
     )
@@ -133,7 +136,6 @@
         OutputGroupInfo(go_generated_srcs = depset(library.srcs)),
     ]
 
-
 sqlc_go_library = rule(
     implementation = _sqlc_go_library,
     attrs = {
diff --git a/build/static_binary_tarball/spec/BUILD.bazel b/build/static_binary_tarball/spec/BUILD.bazel
index 330d4cc..1765147 100644
--- a/build/static_binary_tarball/spec/BUILD.bazel
+++ b/build/static_binary_tarball/spec/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "spec_proto",
diff --git a/build/toolbase/gotoolchain/def.bzl b/build/toolbase/gotoolchain/def.bzl
index dbbba72..efd98a4 100644
--- a/build/toolbase/gotoolchain/def.bzl
+++ b/build/toolbase/gotoolchain/def.bzl
@@ -10,8 +10,6 @@
 def _toolchain_library_impl(ctx):
     go = go_context(ctx)
 
-    importpath = ctx.attr.importpath
-
     out = go.declare_file(go, ext = ".go")
     ctx.actions.expand_template(
         template = ctx.file._template,
diff --git a/build/toolchain/cc_toolchain_config.bzl b/build/toolchain/cc_toolchain_config.bzl
index 0fdb23e..06651d4 100644
--- a/build/toolchain/cc_toolchain_config.bzl
+++ b/build/toolchain/cc_toolchain_config.bzl
@@ -14,8 +14,8 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool", "tool_path")
 load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
+load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool_path")
 
 all_compile_actions = [
     ACTION_NAMES.c_compile,
diff --git a/build/toolchain/llvm-efi/cc_toolchain_config.bzl b/build/toolchain/llvm-efi/cc_toolchain_config.bzl
index 076f5d9..f6de95d 100644
--- a/build/toolchain/llvm-efi/cc_toolchain_config.bzl
+++ b/build/toolchain/llvm-efi/cc_toolchain_config.bzl
@@ -1,5 +1,5 @@
-load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool", "tool_path", "with_feature_set")
 load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
+load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool_path", "with_feature_set")
 
 all_compile_actions = [
     ACTION_NAMES.c_compile,
@@ -197,7 +197,7 @@
         features = [default_link_flags_feature, default_compile_flags_feature, hybrid_gnu_msvc_feature, lto_feature],
         # Needed for various compiler built-in headers and auxiliary data. No system libraries are being used.
         cxx_builtin_include_directories = [
-            "/usr/lib/clang/18/include/"
+            "/usr/lib/clang/18/include/",
         ],
         toolchain_identifier = "k8-toolchain",
         host_system_name = "local",
diff --git a/build/toolchain/llvm-efi/transition.bzl b/build/toolchain/llvm-efi/transition.bzl
index 1edb86b..9c222e6 100644
--- a/build/toolchain/llvm-efi/transition.bzl
+++ b/build/toolchain/llvm-efi/transition.bzl
@@ -1,9 +1,9 @@
-def _build_efi_transition_impl(settings, attr):
+def _build_efi_transition_impl(_settings, _attr):
     """
     Transition that enables building for an EFI environment. Currently only supports C code.
     """
     return {
-        "//command_line_option:platforms": "//build/platforms:efi_amd64"
+        "//command_line_option:platforms": "//build/platforms:efi_amd64",
     }
 
 build_efi_transition = transition(
diff --git a/build/toolchain/musl-host-gcc/sysroot/BUILD.bazel b/build/toolchain/musl-host-gcc/sysroot/BUILD.bazel
index 2979ee1..dbd2982 100644
--- a/build/toolchain/musl-host-gcc/sysroot/BUILD.bazel
+++ b/build/toolchain/musl-host-gcc/sysroot/BUILD.bazel
@@ -1,5 +1,5 @@
-load(":musl.bzl", "musl_headers")
 load(":linux.bzl", "linux_headers")
+load(":musl.bzl", "musl_headers")
 load(":tarball.bzl", "musl_gcc_tarball")
 
 linux_headers(
diff --git a/build/toolchain/musl-host-gcc/sysroot/linux.bzl b/build/toolchain/musl-host-gcc/sysroot/linux.bzl
index e9cf40a..0d6b999 100644
--- a/build/toolchain/musl-host-gcc/sysroot/linux.bzl
+++ b/build/toolchain/musl-host-gcc/sysroot/linux.bzl
@@ -33,7 +33,7 @@
         use_default_shell_env = True,
         command = "make -C \"$1\" headers_install ARCH=\"$2\" INSTALL_HDR_PATH=\"$(pwd)/$3\" > /dev/null && mv \"$3/include/\"* \"$3/\" && rmdir \"$3/include\"",
     )
-    return [DefaultInfo(files=depset([hdrs_dir]))]
+    return [DefaultInfo(files = depset([hdrs_dir]))]
 
 linux_headers = rule(
     implementation = _linux_headers,
diff --git a/build/toolchain/musl-host-gcc/sysroot/musl.bzl b/build/toolchain/musl-host-gcc/sysroot/musl.bzl
index 5055b83..f5dba26 100644
--- a/build/toolchain/musl-host-gcc/sysroot/musl.bzl
+++ b/build/toolchain/musl-host-gcc/sysroot/musl.bzl
@@ -33,7 +33,7 @@
         use_default_shell_env = True,
         command = "make -C \"$1\" install-headers ARCH=\"$2\" includedir=\"$(pwd)/$3\" > /dev/null",
     )
-    return [DefaultInfo(files=depset([hdrs_dir]))]
+    return [DefaultInfo(files = depset([hdrs_dir]))]
 
 musl_headers = rule(
     implementation = _musl_headers,
diff --git a/build/toolchain/musl-host-gcc/sysroot/tarball.bzl b/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
index d7f18aa..a7e407d 100644
--- a/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
+++ b/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
@@ -14,17 +14,17 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load(
-    "//build/utils:detect_root.bzl",
-    "detect_root",
-)
-
 """
 Build a sysroot-style tarball containing musl/linux headers and libraries.
 
 This can then be used to build a C toolchain that builds C/C++ binaries for Metropolis nodes.
 """
 
+load(
+    "//build/utils:detect_root.bzl",
+    "detect_root",
+)
+
 def _musl_gcc_tarball(ctx):
     tarball_name = ctx.attr.name + ".tar.xz"
     tarball = ctx.actions.declare_file(tarball_name)
@@ -37,7 +37,6 @@
     compiler_headers_path = "lib/gcc/x86_64-redhat-linux/14/include"
 
     musl_root = detect_root(ctx.attr.musl)
-    musl_files = ctx.files.musl
 
     # This builds a tarball containing musl, musl headers and linux headers.
     # This is done by some carefully crafted tar command line arguments that rewrite
@@ -50,16 +49,16 @@
 
     # Order is important here as this is a terrible hack producing a tar file with duplicate files. The decompressor
     # will then overwrite the wrong one with the correct one for us.
-    arguments += [compiler_headers_path]
+    arguments.append(compiler_headers_path)
     command += " --transform 's|^'$2'|include|' /$2"
 
-    arguments += [musl_headers_path]
+    arguments.append(musl_headers_path)
     command += " --transform 's|^'$3'|include|' $3"
 
-    arguments += [linux_headers_path]
+    arguments.append(linux_headers_path)
     command += " --transform 's|^'$4'|include|' $4"
 
-    arguments += [musl_root]
+    arguments.append(musl_root)
     command += " --transform 's|^'$5'|lib|' $5"
 
     ctx.actions.run_shell(
diff --git a/build/toolchain/musl-host-gcc/sysroot_repository.bzl b/build/toolchain/musl-host-gcc/sysroot_repository.bzl
index 253abbf..72882ea 100644
--- a/build/toolchain/musl-host-gcc/sysroot_repository.bzl
+++ b/build/toolchain/musl-host-gcc/sysroot_repository.bzl
@@ -30,7 +30,6 @@
 )
 """)
 
-
 musl_sysroot_rule = repository_rule(
     implementation = _musl_sysroot_rule_impl,
     attrs = {
diff --git a/build/utils/detect_root.bzl b/build/utils/detect_root.bzl
index 50c9574..e52c6ca 100644
--- a/build/utils/detect_root.bzl
+++ b/build/utils/detect_root.bzl
@@ -57,7 +57,7 @@
 
 def _get_level(path):
     normalized = path
-    for i in range(len(path)):
+    for _ in range(len(path)):
         new_normalized = normalized.replace("//", "/")
         if len(new_normalized) == len(normalized):
             break
diff --git a/cloud/BUILD.bazel b/cloud/BUILD.bazel
index 04222e7..cfafaa7 100644
--- a/cloud/BUILD.bazel
+++ b/cloud/BUILD.bazel
@@ -1,5 +1,7 @@
+load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@rules_multirun//:defs.bzl", "multirun")
+load("@rules_oci//oci:defs.bzl", "oci_push")
 
 write_file(
     name = "tags_tmpl",
@@ -9,8 +11,6 @@
     ],
 )
 
-load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
-
 # Use the value of --embed_label under --stamp, otherwise use a deterministic constant
 # value to ensure cache hits for actions that depend on this.
 expand_template(
@@ -21,8 +21,6 @@
     template = "tags_tmpl",
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_push")
-
 oci_push(
     name = "apigw_image",
     image = "//cloud/apigw:apigw_image",
diff --git a/cloud/agent/api/BUILD.bazel b/cloud/agent/api/BUILD.bazel
index ba31094..73c73b7 100644
--- a/cloud/agent/api/BUILD.bazel
+++ b/cloud/agent/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/cloud/agent/e2e/BUILD.bazel b/cloud/agent/e2e/BUILD.bazel
index 39dd031..c859c2b 100644
--- a/cloud/agent/e2e/BUILD.bazel
+++ b/cloud/agent/e2e/BUILD.bazel
@@ -24,7 +24,7 @@
         "//osbase/pki",
         "@com_github_cavaliergopher_cpio//:cpio",
         "@com_github_klauspost_compress//zstd",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//credentials",
         "@org_golang_google_protobuf//proto",
diff --git a/cloud/agent/takeover/BUILD.bazel b/cloud/agent/takeover/BUILD.bazel
index 2b28464..6fe88bd 100644
--- a/cloud/agent/takeover/BUILD.bazel
+++ b/cloud/agent/takeover/BUILD.bazel
@@ -2,7 +2,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 load("//osbase/build:def.bzl", "node_initramfs")
-load("//osbase/build/fwprune:def.bzl", "fsspec_linux_firmware")
 
 go_library(
     name = "takeover_lib",
diff --git a/cloud/agent/takeover/e2e/BUILD.bazel b/cloud/agent/takeover/e2e/BUILD.bazel
index 3ca92ee..0333753 100644
--- a/cloud/agent/takeover/e2e/BUILD.bazel
+++ b/cloud/agent/takeover/e2e/BUILD.bazel
@@ -22,7 +22,7 @@
         "//osbase/fat32",
         "//osbase/freeport",
         "@com_github_pkg_sftp//:sftp",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_google_protobuf//proto",
         "@org_golang_x_crypto//ssh",
     ],
diff --git a/cloud/api/BUILD.bazel b/cloud/api/BUILD.bazel
index 363713f..c9e2abf 100644
--- a/cloud/api/BUILD.bazel
+++ b/cloud/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/cloud/apigw/BUILD.bazel b/cloud/apigw/BUILD.bazel
index a570529..7d2114d 100644
--- a/cloud/apigw/BUILD.bazel
+++ b/cloud/apigw/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "apigw_lib",
@@ -17,15 +19,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "apigw_layer",
     srcs = [":apigw"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "apigw_image",
     base = "@distroless_base",
diff --git a/cloud/bmaas/scruffy/cmd/BUILD.bazel b/cloud/bmaas/scruffy/cmd/BUILD.bazel
index 1d919b4..9284aae 100644
--- a/cloud/bmaas/scruffy/cmd/BUILD.bazel
+++ b/cloud/bmaas/scruffy/cmd/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "cmd_lib",
@@ -14,15 +16,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "cmd_layer",
     srcs = [":cmd"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "cmd_image",
     base = "@distroless_base",
diff --git a/cloud/bmaas/server/api/BUILD.bazel b/cloud/bmaas/server/api/BUILD.bazel
index 10037e1..96c56ab 100644
--- a/cloud/bmaas/server/api/BUILD.bazel
+++ b/cloud/bmaas/server/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/cloud/bmaas/server/cmd/BUILD.bazel b/cloud/bmaas/server/cmd/BUILD.bazel
index 9f3ce58..cbfdfed 100644
--- a/cloud/bmaas/server/cmd/BUILD.bazel
+++ b/cloud/bmaas/server/cmd/BUILD.bazel
@@ -1,5 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "cmd_lib",
@@ -18,15 +19,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "cmd_layer",
     srcs = [":cmd"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "cmd_image",
     base = "@distroless_base",
diff --git a/cloud/lib/component/BUILD.bazel b/cloud/lib/component/BUILD.bazel
index 5f85b83..e751aaf 100644
--- a/cloud/lib/component/BUILD.bazel
+++ b/cloud/lib/component/BUILD.bazel
@@ -20,7 +20,7 @@
         "@com_github_prometheus_client_golang//prometheus",
         "@com_github_prometheus_client_golang//prometheus/collectors",
         "@com_github_prometheus_client_golang//prometheus/promhttp",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@io_k8s_klog_v2//:klog",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//credentials",
diff --git a/cloud/shepherd/mini/BUILD.bazel b/cloud/shepherd/mini/BUILD.bazel
index f8a5e72..948eb40 100644
--- a/cloud/shepherd/mini/BUILD.bazel
+++ b/cloud/shepherd/mini/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "mini_lib",
@@ -28,15 +30,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "mini_layer",
     srcs = [":mini"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "mini_image",
     base = "@distroless_base",
diff --git a/cloud/shepherd/provider/equinix/BUILD.bazel b/cloud/shepherd/provider/equinix/BUILD.bazel
index ef1ab53..23502b3 100644
--- a/cloud/shepherd/provider/equinix/BUILD.bazel
+++ b/cloud/shepherd/provider/equinix/BUILD.bazel
@@ -1,4 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
+load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "equinix_lib",
@@ -57,15 +59,11 @@
     visibility = ["//visibility:public"],
 )
 
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
 pkg_tar(
     name = "equinix_layer",
     srcs = [":equinix"],
 )
 
-load("@rules_oci//oci:defs.bzl", "oci_image")
-
 oci_image(
     name = "equinix_image",
     base = "@distroless_base",
diff --git a/metropolis/cli/metroctl/BUILD.bazel b/metropolis/cli/metroctl/BUILD.bazel
index 6d9f32a..f4c5c15 100644
--- a/metropolis/cli/metroctl/BUILD.bazel
+++ b/metropolis/cli/metroctl/BUILD.bazel
@@ -56,7 +56,7 @@
         "@com_github_adrg_xdg//:xdg",
         "@com_github_schollz_progressbar_v3//:progressbar",
         "@com_github_spf13_cobra//:cobra",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
         "@io_k8s_client_go//pkg/apis/clientauthentication/v1:clientauthentication",
         "@io_k8s_utils//ptr",
diff --git a/metropolis/cli/metroctl/defs.bzl b/metropolis/cli/metroctl/defs.bzl
index ce75195..dbebca2 100644
--- a/metropolis/cli/metroctl/defs.bzl
+++ b/metropolis/cli/metroctl/defs.bzl
@@ -1,12 +1,15 @@
-BuildKindProvider = provider(fields = ['type'])
+BuildKindInfo = provider(
+    "Build kind for userspace tools",
+    fields = ["type"],
+)
 
 def _impl(ctx):
-    values = ['full', 'lite'] 
+    values = ["full", "lite"]
     value = ctx.build_setting_value
     if value not in values:
         fail(str(ctx.label) + " build setting allowed to take values {full, lite} but was set to " + value)
 
-    return BuildKindProvider(type = value)
+    return BuildKindInfo(type = value)
 
 buildkind = rule(
     implementation = _impl,
diff --git a/metropolis/cli/metroctl/test/BUILD.bazel b/metropolis/cli/metroctl/test/BUILD.bazel
index f849949..8f58a9a 100644
--- a/metropolis/cli/metroctl/test/BUILD.bazel
+++ b/metropolis/cli/metroctl/test/BUILD.bazel
@@ -16,6 +16,6 @@
         "//metropolis/version",
         "//osbase/cmd",
         "//version",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
     ],
 )
diff --git a/metropolis/cli/takeover/e2e/BUILD.bazel b/metropolis/cli/takeover/e2e/BUILD.bazel
index 81ff44a..1f96fe2 100644
--- a/metropolis/cli/takeover/e2e/BUILD.bazel
+++ b/metropolis/cli/takeover/e2e/BUILD.bazel
@@ -24,7 +24,7 @@
         "//metropolis/test/launch",
         "//osbase/fat32",
         "//osbase/freeport",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_google_protobuf//proto",
         "@org_golang_x_crypto//ssh",
         "@org_golang_x_sys//unix",
diff --git a/metropolis/handbook/defs.bzl b/metropolis/handbook/defs.bzl
index ffd0b84..2ad44f3 100644
--- a/metropolis/handbook/defs.bzl
+++ b/metropolis/handbook/defs.bzl
@@ -21,7 +21,7 @@
     # SUMMARY.md and the parent directory of that is the root.
     summary = None
     for f in ctx.files.srcs:
-        if not f.path.endswith('/SUMMARY.md'):
+        if not f.path.endswith("/SUMMARY.md"):
             continue
         if summary != None:
             fail("More then one SUMMARY.md provided.")
@@ -41,8 +41,8 @@
     # Then we will need to prepend:
     #   ../../../../../../../
     # To get back to execroot/.
-    prepend = len(out_book_toml.path.split('/')) - 1
-    src_dir_path = ('../' * prepend) + summary.dirname
+    prepend = len(out_book_toml.path.split("/")) - 1
+    src_dir_path = ("../" * prepend) + summary.dirname
 
     # Generate book.toml.
     # Bazel does not have a toml library. We abuse JSON encoding to get
@@ -58,27 +58,29 @@
     ]
     ctx.actions.write(
         output = out_book_toml,
-        content = "\n".join(book_toml_contents)
+        content = "\n".join(book_toml_contents),
     )
 
     out_dir = ctx.actions.declare_directory(ctx.attr.name)
+
     # We also have to prepend the out dir path, for the same reasons for which
     # we prepend src_dir_path above.
-    out_dir_path = ('../' * prepend) + out_dir.path
+    out_dir_path = ("../" * prepend) + out_dir.path
     ctx.actions.run(
         executable = ctx.executable._mdbook,
         arguments = [
             "build",
-            "-d", out_dir_path,
+            "-d",
+            out_dir_path,
             out_book_toml.dirname,
         ],
-        inputs = ctx.files.srcs + [ out_book_toml ],
-        outputs = [ out_dir ],
+        inputs = ctx.files.srcs + [out_book_toml],
+        outputs = [out_dir],
     )
     return [
         DefaultInfo(
             files = depset([out_dir]),
-        )
+        ),
     ]
 
 mdbook_html = rule(
@@ -100,11 +102,10 @@
             allow_files = True,
             doc = "The sources of the generated book. Exaclty one file must be named SUMMARY.md, and that file's location will be used to determine the root of the book sources.",
         ),
-
         "_mdbook": attr.label(
             doc = "The mdbook tool.",
             executable = True,
-            cfg = "host",
+            cfg = "exec",
             default = "@crate_index//:mdbook__mdbook",
         ),
     },
diff --git a/metropolis/installer/BUILD.bazel b/metropolis/installer/BUILD.bazel
index 4fcd58c..61cf7b6 100644
--- a/metropolis/installer/BUILD.bazel
+++ b/metropolis/installer/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 load("//osbase/build:def.bzl", "node_initramfs")
-load("//osbase/build/genosrelease:defs.bzl", "os_release")
 load("//osbase/build:efi.bzl", "efi_unified_kernel_image")
+load("//osbase/build/genosrelease:defs.bzl", "os_release")
 
 go_library(
     name = "installer_lib",
diff --git a/metropolis/installer/test/BUILD.bazel b/metropolis/installer/test/BUILD.bazel
index 468d452..7390cf6 100644
--- a/metropolis/installer/test/BUILD.bazel
+++ b/metropolis/installer/test/BUILD.bazel
@@ -27,7 +27,7 @@
         "@com_github_diskfs_go_diskfs//:go-diskfs",
         "@com_github_diskfs_go_diskfs//disk",
         "@com_github_diskfs_go_diskfs//partition/gpt",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
     ],
 )
 
diff --git a/metropolis/installer/test/testos/BUILD.bazel b/metropolis/installer/test/testos/BUILD.bazel
index d1ae0df..c41fbee 100644
--- a/metropolis/installer/test/testos/BUILD.bazel
+++ b/metropolis/installer/test/testos/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_pkg//:pkg.bzl", "pkg_zip")
 load("//osbase/build:def.bzl", "erofs_image", "verity_image")
 load("//osbase/build:efi.bzl", "efi_unified_kernel_image")
-load("@rules_pkg//:pkg.bzl", "pkg_zip")
 
 erofs_image(
     name = "rootfs",
diff --git a/metropolis/node/core/abloader/spec/BUILD.bazel b/metropolis/node/core/abloader/spec/BUILD.bazel
index 54d96cc..cfe921f 100644
--- a/metropolis/node/core/abloader/spec/BUILD.bazel
+++ b/metropolis/node/core/abloader/spec/BUILD.bazel
@@ -1,7 +1,7 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
-load("@rules_rust//proto/prost:defs.bzl", "rust_prost_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@rules_rust//proto/prost:defs.bzl", "rust_prost_library")
 
 proto_library(
     name = "abloader_proto",
diff --git a/metropolis/node/core/bios_bootcode/genlogo/def.bzl b/metropolis/node/core/bios_bootcode/genlogo/def.bzl
index 11a56cd..5db80ee 100644
--- a/metropolis/node/core/bios_bootcode/genlogo/def.bzl
+++ b/metropolis/node/core/bios_bootcode/genlogo/def.bzl
@@ -16,8 +16,6 @@
         files = depset([output]),
     )
 
-    pass
-
 gen_logo = rule(
     implementation = _build_logo_impl,
     attrs = {
diff --git a/metropolis/node/core/curator/proto/api/BUILD.bazel b/metropolis/node/core/curator/proto/api/BUILD.bazel
index dbc1cbf..e7315f2 100644
--- a/metropolis/node/core/curator/proto/api/BUILD.bazel
+++ b/metropolis/node/core/curator/proto/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/metropolis/node/core/curator/proto/private/BUILD.bazel b/metropolis/node/core/curator/proto/private/BUILD.bazel
index 035f007..9a1ad4b 100644
--- a/metropolis/node/core/curator/proto/private/BUILD.bazel
+++ b/metropolis/node/core/curator/proto/private/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "private_proto",
diff --git a/metropolis/node/core/metrics/BUILD.bazel b/metropolis/node/core/metrics/BUILD.bazel
index 9383afb..893a6c4 100644
--- a/metropolis/node/core/metrics/BUILD.bazel
+++ b/metropolis/node/core/metrics/BUILD.bazel
@@ -38,6 +38,6 @@
         "//osbase/freeport",
         "//osbase/supervisor",
         "@com_zx2c4_golang_wireguard_wgctrl//wgtypes",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
     ],
 )
diff --git a/metropolis/node/core/update/e2e/BUILD.bazel b/metropolis/node/core/update/e2e/BUILD.bazel
index 71be003..3f6aa66 100644
--- a/metropolis/node/core/update/e2e/BUILD.bazel
+++ b/metropolis/node/core/update/e2e/BUILD.bazel
@@ -28,6 +28,6 @@
         "//osbase/blkio",
         "//osbase/blockdev",
         "//osbase/build/mkimage/osimage",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
     ],
 )
diff --git a/metropolis/node/core/update/e2e/testos/testos.bzl b/metropolis/node/core/update/e2e/testos/testos.bzl
index 9db31c2..a019bc9 100644
--- a/metropolis/node/core/update/e2e/testos/testos.bzl
+++ b/metropolis/node/core/update/e2e/testos/testos.bzl
@@ -1,8 +1,8 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
+load("@rules_pkg//:mappings.bzl", "pkg_files")
+load("@rules_pkg//:pkg.bzl", "pkg_zip")
 load("//osbase/build:def.bzl", "erofs_image", "verity_image")
 load("//osbase/build:efi.bzl", "efi_unified_kernel_image")
-load("@rules_pkg//:pkg.bzl", "pkg_zip")
-load("@rules_pkg//:mappings.bzl", "pkg_files")
 
 # Macro for generating multiple TestOS instances to check if the updater works.
 def testos(variant):
diff --git a/metropolis/proto/BUILD.bazel b/metropolis/proto/BUILD.bazel
index 42aecdc..d3a0f89 100644
--- a/metropolis/proto/BUILD.bazel
+++ b/metropolis/proto/BUILD.bazel
@@ -1,4 +1,4 @@
-load("@rules_proto_grpc_buf//:defs.bzl", "buf_proto_breaking_test", "buf_proto_lint_test")
+load("@rules_proto_grpc_buf//:defs.bzl", "buf_proto_lint_test")
 load("@rules_proto_grpc_doc//:defs.bzl", "doc_html_compile")
 
 doc_html_compile(
diff --git a/metropolis/proto/api/BUILD.bazel b/metropolis/proto/api/BUILD.bazel
index 294dcb8..b1e84e6 100644
--- a/metropolis/proto/api/BUILD.bazel
+++ b/metropolis/proto/api/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "api_proto",
diff --git a/metropolis/proto/common/BUILD.bazel b/metropolis/proto/common/BUILD.bazel
index 41a5405..031a27c 100644
--- a/metropolis/proto/common/BUILD.bazel
+++ b/metropolis/proto/common/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "common_proto",
diff --git a/metropolis/proto/ext/BUILD.bazel b/metropolis/proto/ext/BUILD.bazel
index aeb6d69..01112b0 100644
--- a/metropolis/proto/ext/BUILD.bazel
+++ b/metropolis/proto/ext/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "ext_proto",
diff --git a/metropolis/proto/private/BUILD.bazel b/metropolis/proto/private/BUILD.bazel
index 1729ce9..e15ddf9 100644
--- a/metropolis/proto/private/BUILD.bazel
+++ b/metropolis/proto/private/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "private_proto",
diff --git a/metropolis/test/e2e/suites/core/BUILD.bazel b/metropolis/test/e2e/suites/core/BUILD.bazel
index a8c90ad..662ed28 100644
--- a/metropolis/test/e2e/suites/core/BUILD.bazel
+++ b/metropolis/test/e2e/suites/core/BUILD.bazel
@@ -24,7 +24,7 @@
         "//metropolis/test/localregistry",
         "//metropolis/test/util",
         "//osbase/test/launch",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_google_grpc//:grpc",
     ],
 )
diff --git a/metropolis/test/e2e/suites/ha/BUILD.bazel b/metropolis/test/e2e/suites/ha/BUILD.bazel
index 3d9c688..cc792a3 100644
--- a/metropolis/test/e2e/suites/ha/BUILD.bazel
+++ b/metropolis/test/e2e/suites/ha/BUILD.bazel
@@ -20,6 +20,6 @@
         "//metropolis/test/localregistry",
         "//metropolis/test/util",
         "//osbase/test/launch",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
     ],
 )
diff --git a/metropolis/test/e2e/suites/kubernetes/BUILD.bazel b/metropolis/test/e2e/suites/kubernetes/BUILD.bazel
index 8a2acba..fbfad4d 100644
--- a/metropolis/test/e2e/suites/kubernetes/BUILD.bazel
+++ b/metropolis/test/e2e/suites/kubernetes/BUILD.bazel
@@ -40,7 +40,7 @@
         "//metropolis/test/launch",
         "//metropolis/test/localregistry",
         "//metropolis/test/util",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@io_k8s_api//core/v1:core",
         "@io_k8s_apimachinery//pkg/api/errors",
         "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
diff --git a/metropolis/test/launch/BUILD.bazel b/metropolis/test/launch/BUILD.bazel
index fca8bbf..fa66e5a 100644
--- a/metropolis/test/launch/BUILD.bazel
+++ b/metropolis/test/launch/BUILD.bazel
@@ -53,7 +53,7 @@
         "//osbase/test/launch",
         "@com_github_cenkalti_backoff_v4//:backoff",
         "@com_github_kballard_go_shellquote//:go-shellquote",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@io_k8s_client_go//kubernetes",
         "@io_k8s_client_go//rest",
         "@io_k8s_utils//ptr",
diff --git a/metropolis/test/launch/cli/launch-cluster/BUILD.bazel b/metropolis/test/launch/cli/launch-cluster/BUILD.bazel
index 250a1b1..5b58b9b 100644
--- a/metropolis/test/launch/cli/launch-cluster/BUILD.bazel
+++ b/metropolis/test/launch/cli/launch-cluster/BUILD.bazel
@@ -1,5 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("@bazel_skylib//rules:native_binary.bzl", "native_test")
 
 go_library(
     name = "launch-cluster_lib",
@@ -18,7 +17,7 @@
         "//metropolis/node",
         "//metropolis/proto/common",
         "//metropolis/test/launch",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
     ],
 )
 
diff --git a/metropolis/test/launch/cli/launch/BUILD.bazel b/metropolis/test/launch/cli/launch/BUILD.bazel
index 038373f..72825d9 100644
--- a/metropolis/test/launch/cli/launch/BUILD.bazel
+++ b/metropolis/test/launch/cli/launch/BUILD.bazel
@@ -1,4 +1,3 @@
-load("@bazel_skylib//rules:native_binary.bzl", "native_test")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
diff --git a/metropolis/test/localregistry/BUILD.bazel b/metropolis/test/localregistry/BUILD.bazel
index 548960a..fa1f229 100644
--- a/metropolis/test/localregistry/BUILD.bazel
+++ b/metropolis/test/localregistry/BUILD.bazel
@@ -13,7 +13,7 @@
         "@com_github_docker_distribution//manifest/schema2",
         "@com_github_docker_distribution//reference",
         "@com_github_opencontainers_go_digest//:go-digest",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_google_protobuf//encoding/prototext",
     ],
 )
diff --git a/metropolis/test/localregistry/def.bzl b/metropolis/test/localregistry/def.bzl
index c5fc560..289dc34 100644
--- a/metropolis/test/localregistry/def.bzl
+++ b/metropolis/test/localregistry/def.bzl
@@ -1,7 +1,7 @@
 #load("@io_bazel_rules_docker//container:providers.bzl", "ImageInfo")
 
 def _localregistry_manifest_impl(ctx):
-    manifest_out = ctx.actions.declare_file(ctx.label.name+".prototxt")
+    manifest_out = ctx.actions.declare_file(ctx.label.name + ".prototxt")
 
     images = []
     referenced = [manifest_out]
@@ -17,7 +17,6 @@
     ctx.actions.write(manifest_out, proto.encode_text(struct(images = images)))
     return [DefaultInfo(runfiles = ctx.runfiles(files = referenced), files = depset([manifest_out]))]
 
-
 localregistry_manifest = rule(
     implementation = _localregistry_manifest_impl,
     doc = """
@@ -29,7 +28,7 @@
             doc = """
                 List of images to be served from the local registry.
             """,
-           providers = [],
+            providers = [],
         ),
     },
 )
diff --git a/metropolis/test/localregistry/spec/BUILD.bazel b/metropolis/test/localregistry/spec/BUILD.bazel
index 71253d1..871fe35 100644
--- a/metropolis/test/localregistry/spec/BUILD.bazel
+++ b/metropolis/test/localregistry/spec/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "spec_proto",
diff --git a/osbase/bringup/BUILD.bazel b/osbase/bringup/BUILD.bazel
index 89b40ff..e8e5c75 100644
--- a/osbase/bringup/BUILD.bazel
+++ b/osbase/bringup/BUILD.bazel
@@ -1,5 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//osbase/build:def.bzl", "node_initramfs")
 
 go_library(
     name = "bringup",
diff --git a/osbase/bringup/test/BUILD.bazel b/osbase/bringup/test/BUILD.bazel
index ecb893d..a791a66 100644
--- a/osbase/bringup/test/BUILD.bazel
+++ b/osbase/bringup/test/BUILD.bazel
@@ -22,7 +22,7 @@
     },
     deps = [
         "//osbase/cmd",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
     ],
 )
 
diff --git a/osbase/build/def.bzl b/osbase/build/def.bzl
index 24f2af7..57a7dab 100644
--- a/osbase/build/def.bzl
+++ b/osbase/build/def.bzl
@@ -1,21 +1,4 @@
-#  Copyright 2020 The Monogon Project Authors.
-#
-#  SPDX-License-Identifier: Apache-2.0
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-load("@bazel_skylib//lib:paths.bzl", "paths")
-
-def _build_pure_transition_impl(settings, attr):
+def _build_pure_transition_impl(settings, _attr):
     """
     Transition that enables pure, static build of Go binaries.
     """
@@ -40,7 +23,7 @@
     ],
 )
 
-def _build_static_transition_impl(settings, attr):
+def _build_static_transition_impl(_settings, _attr):
     """
     Transition that enables static builds with CGo and musl for Go binaries.
     """
@@ -116,9 +99,9 @@
 
     for fsspec in ctx.attr.fsspecs:
         if FSSpecInfo in fsspec:
-            fsspecInfo = fsspec[FSSpecInfo]
-            extra_specs.append(fsspecInfo.spec)
-            for f in fsspecInfo.referenced:
+            fsspec_info = fsspec[FSSpecInfo]
+            extra_specs.append(fsspec_info.spec)
+            for f in fsspec_info.referenced:
                 inputs.append(f)
         else:
             # Raw .fsspec prototext. No referenced data allowed.
@@ -254,15 +237,15 @@
         "_mkerofs": attr.label(
             default = Label("//osbase/build/mkerofs"),
             executable = True,
-            cfg = "host",
+            cfg = "exec",
         ),
     },
 )
 
-# VerityConfig is emitted by verity_image, and contains a file enclosing a
+# VerityInfo is emitted by verity_image, and contains a file enclosing a
 # singular dm-verity target table.
-VerityConfig = provider(
-    "Configuration necessary to mount a single dm-verity target.",
+VerityInfo = provider(
+    "Information necessary to mount a single dm-verity target.",
     fields = {
         "table": "A file containing the dm-verity target table. See: https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html",
     },
@@ -272,7 +255,7 @@
     """
     Create a new file containing the source image data together with the Verity
     metadata appended to it, and provide an associated DeviceMapper Verity target
-    table in a separate file, through VerityConfig provider.
+    table in a separate file, through VerityInfo provider.
     """
 
     # Run mkverity.
@@ -301,7 +284,7 @@
             files = depset([image]),
             runfiles = ctx.runfiles(files = [image]),
         ),
-        VerityConfig(
+        VerityInfo(
             table = table,
         ),
     ]
@@ -311,7 +294,7 @@
     doc = """
       Build a dm-verity target image by appending Verity metadata to the source
       image. A corresponding dm-verity target table will be made available
-      through VerityConfig provider.
+      through VerityInfo provider.
   """,
     attrs = {
         "source": attr.label(
@@ -327,7 +310,7 @@
             default = "//osbase/build/mkverity",
             allow_single_file = True,
             executable = True,
-            cfg = "host",
+            cfg = "exec",
         ),
     },
 )
diff --git a/osbase/build/efi.bzl b/osbase/build/efi.bzl
index 7488650..54b43a6 100644
--- a/osbase/build/efi.bzl
+++ b/osbase/build/efi.bzl
@@ -4,7 +4,7 @@
 """
 
 load("//build/toolchain/llvm-efi:transition.bzl", "build_efi_transition")
-load("//osbase/build:def.bzl", "VerityConfig")
+load("//osbase/build:def.bzl", "VerityInfo")
 
 def _efi_unified_kernel_image_impl(ctx):
     # Find the dependency paths to be passed to mkpayload.
@@ -25,9 +25,9 @@
         )
         deps["cmdline"] = cmdline
 
-    # Get the dm-verity target table from VerityConfig provider.
+    # Get the dm-verity target table from VerityInfo provider.
     if ctx.attr.verity:
-        deps["rootfs_dm_table"] = ctx.attr.verity[VerityConfig].table
+        deps["rootfs_dm_table"] = ctx.attr.verity[VerityInfo].table
 
     # Format deps into command line arguments while keeping track of mkpayload
     # runtime inputs.
@@ -119,7 +119,7 @@
         "verity": attr.label(
             doc = "The DeviceMapper Verity rootfs target table.",
             allow_single_file = True,
-            providers = [DefaultInfo, VerityConfig],
+            providers = [DefaultInfo, VerityInfo],
         ),
         "_mkpayload": attr.label(
             doc = "The mkpayload executable.",
@@ -130,6 +130,6 @@
         ),
     },
     toolchains = [
-        "@bazel_tools//tools/cpp:toolchain_type"
+        "@bazel_tools//tools/cpp:toolchain_type",
     ],
 )
diff --git a/osbase/build/fsspec/BUILD.bazel b/osbase/build/fsspec/BUILD.bazel
index b719522..c3ebdfc 100644
--- a/osbase/build/fsspec/BUILD.bazel
+++ b/osbase/build/fsspec/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "spec_proto",
diff --git a/osbase/build/genosrelease/defs.bzl b/osbase/build/genosrelease/defs.bzl
index 6fed483..2e7c613 100644
--- a/osbase/build/genosrelease/defs.bzl
+++ b/osbase/build/genosrelease/defs.bzl
@@ -43,7 +43,7 @@
         "stamp_var": attr.string(mandatory = True),
         "_genosrelease": attr.label(
             default = Label("//osbase/build/genosrelease"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/osbase/build/mkucode/spec/BUILD.bazel b/osbase/build/mkucode/spec/BUILD.bazel
index 0210a4b..6a01dbc 100644
--- a/osbase/build/mkucode/spec/BUILD.bazel
+++ b/osbase/build/mkucode/spec/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "mkucode_proto",
diff --git a/osbase/fat32/BUILD.bazel b/osbase/fat32/BUILD.bazel
index e329179..4942844 100644
--- a/osbase/fat32/BUILD.bazel
+++ b/osbase/fat32/BUILD.bazel
@@ -30,7 +30,7 @@
     deps = [
         "@com_github_stretchr_testify//assert",
         "@com_github_stretchr_testify//require",
-        "@io_bazel_rules_go//go/runfiles:go_default_library",
+        "@io_bazel_rules_go//go/runfiles",
         "@org_golang_x_sys//unix",
     ],
 )
diff --git a/osbase/kmod/spec/BUILD.bazel b/osbase/kmod/spec/BUILD.bazel
index 75bcf63..bc58404 100644
--- a/osbase/kmod/spec/BUILD.bazel
+++ b/osbase/kmod/spec/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "spec_proto",
diff --git a/osbase/logtree/proto/BUILD.bazel b/osbase/logtree/proto/BUILD.bazel
index b049d80..3e47ca5 100644
--- a/osbase/logtree/proto/BUILD.bazel
+++ b/osbase/logtree/proto/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "proto_proto",
diff --git a/osbase/net/proto/BUILD.bazel b/osbase/net/proto/BUILD.bazel
index cdc115e..c8f4523 100644
--- a/osbase/net/proto/BUILD.bazel
+++ b/osbase/net/proto/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "net_proto_proto",
diff --git a/osbase/tpm/proto/BUILD.bazel b/osbase/tpm/proto/BUILD.bazel
index 31cfda8..6e5f11d 100644
--- a/osbase/tpm/proto/BUILD.bazel
+++ b/osbase/tpm/proto/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "proto_proto",
diff --git a/third_party/BUILD.bazel b/third_party/BUILD.bazel
index 6920dfa..80b8cfb 100644
--- a/third_party/BUILD.bazel
+++ b/third_party/BUILD.bazel
@@ -1,4 +1,5 @@
 load("//osbase/build/fwprune:def.bzl", "fsspec_linux_firmware")
+load("//osbase/build/mkucode:def.bzl", "cpio_ucode")
 
 fsspec_linux_firmware(
     name = "firmware",
@@ -8,8 +9,6 @@
     visibility = ["//visibility:public"],
 )
 
-load("//osbase/build/mkucode:def.bzl", "cpio_ucode")
-
 cpio_ucode(
     name = "ucode",
     ucode = {
diff --git a/third_party/cap/cap.bzl b/third_party/cap/cap.bzl
index 459c89b..5d93890 100644
--- a/third_party/cap/cap.bzl
+++ b/third_party/cap/cap.bzl
@@ -14,8 +14,8 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 cc_library(
     name = "cap",
diff --git a/third_party/chrony/chrony.bzl b/third_party/chrony/chrony.bzl
index bb1477c..afecf26 100644
--- a/third_party/chrony/chrony.bzl
+++ b/third_party/chrony/chrony.bzl
@@ -1,5 +1,5 @@
-load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 
 template_file(
     name = "config.h",
diff --git a/third_party/dosfstools/dosfstools.bzl b/third_party/dosfstools/dosfstools.bzl
index cfe4b28..e8d966d 100644
--- a/third_party/dosfstools/dosfstools.bzl
+++ b/third_party/dosfstools/dosfstools.bzl
@@ -1,5 +1,5 @@
-load("@rules_cc//cc:defs.bzl", "cc_binary")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_binary")
 
 cc_binary(
     name = "fsck",
diff --git a/third_party/linux/def.bzl b/third_party/linux/def.bzl
index 0efbb64..4c6798c 100644
--- a/third_party/linux/def.bzl
+++ b/third_party/linux/def.bzl
@@ -25,7 +25,6 @@
 
 load("//build/utils:detect_root.bzl", "detect_root")
 
-
 _new_settings = {
     # This list should be expanded with any configuration options that end
     # up reaching this rule with different values across different build
@@ -40,8 +39,7 @@
     "//command_line_option:platforms": "//build/platforms:linux_amd64_static",
 }
 
-
-def _ignore_unused_configuration_impl(settings, attr):
+def _ignore_unused_configuration_impl(_settings, _attr):
     return _new_settings
 
 # Transition to flip all known-unimportant but varying configuration options to
@@ -66,15 +64,17 @@
 
     See `resource_set` documentation in builtins.actions Bazel docs.
     """
+
     # 16 threads seems about right - this fits well in both our build machines and
     # development machines.
     cpu = 16
+
     # In MB. Picked based on observing build in htop.
     mb_per_cpu = 256
     return {
-        'cpu': cpu,
-        'memory': cpu * mb_per_cpu,
-        'local_test': 0,
+        "cpu": cpu,
+        "memory": cpu * mb_per_cpu,
+        "local_test": 0,
     }
 
 def _linux_image_impl(ctx):
@@ -89,8 +89,8 @@
     # (image_name) is the name of the image that will be generated by this
     # rule.
     (target, image_source, image_name) = {
-        'vmlinux': ('vmlinux modules', 'vmlinux', 'vmlinux'),
-        'bzImage': ('all modules', 'arch/x86/boot/bzImage', 'bzImage'),
+        "vmlinux": ("vmlinux modules", "vmlinux", "vmlinux"),
+        "bzImage": ("all modules", "arch/x86/boot/bzImage", "bzImage"),
     }[image_format]
 
     # Root of the given Linux sources.
@@ -100,8 +100,8 @@
     modinfo = ctx.actions.declare_file("modules.builtin.modinfo")
     modules = ctx.actions.declare_directory("modules")
     ctx.actions.run_shell(
-        outputs = [ image, modinfo, modules ],
-        inputs = [ kernel_config ] + kernel_src,
+        outputs = [image, modinfo, modules],
+        inputs = [kernel_config] + kernel_src,
         resource_set = _linux_image_impl_resources,
         command = '''
             kconfig=$1
@@ -138,47 +138,48 @@
     )
 
     return [
-      DefaultInfo(
-        files=depset([image]),
-        runfiles=ctx.runfiles(files=[image])
-      ),
-      OutputGroupInfo(
-        modinfo = depset([modinfo]),
-        modules = depset([modules])
-      )
+        DefaultInfo(
+            files = depset([image]),
+            runfiles = ctx.runfiles(files = [image]),
+        ),
+        OutputGroupInfo(
+            modinfo = depset([modinfo]),
+            modules = depset([modules]),
+        ),
     ]
 
 linux_image = rule(
-    doc = '''
+    doc = """
         Build Linux kernel image unhermetically in a given format.
-    ''',
+    """,
     implementation = _linux_image_impl,
     cfg = ignore_unused_configuration,
     attrs = {
         "kernel_config": attr.label(
-            doc = '''
+            doc = """
                 Linux kernel configuration file to build this kernel image with.
-            ''',
+            """,
             allow_single_file = True,
             default = ":linux-metropolis.config",
         ),
         "kernel_src": attr.label(
-            doc = '''
+            doc = """
                 Filegroup containing Linux kernel sources.
-            ''',
+            """,
             default = "@linux//:all",
         ),
         "image_format": attr.string(
-            doc = '''
+            doc = """
                 Format of generated Linux image, one of 'vmlinux' or 'bzImage',
-            ''',
+            """,
             values = [
-                'vmlinux', 'bzImage',
+                "vmlinux",
+                "bzImage",
             ],
-            default = 'bzImage',
+            default = "bzImage",
         ),
         "_allowlist_function_transition": attr.label(
-            default = "@bazel_tools//tools/allowlists/function_transition_allowlist"
+            default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
         ),
     },
 )
diff --git a/third_party/sandboxroot/BUILD.bazel b/third_party/sandboxroot/BUILD.bazel
index 9162616..ed4c773 100644
--- a/third_party/sandboxroot/BUILD.bazel
+++ b/third_party/sandboxroot/BUILD.bazel
@@ -1,5 +1,5 @@
-load("@bazeldnf//:deps.bzl", "rpmtree")
 load("@bazeldnf//:def.bzl", "bazeldnf")
+load("@bazeldnf//:deps.bzl", "rpmtree")
 
 bazeldnf(
     name = "sandboxroot",
diff --git a/third_party/seccomp/seccomp.bzl b/third_party/seccomp/seccomp.bzl
index 4f94aa6..9a010af 100644
--- a/third_party/seccomp/seccomp.bzl
+++ b/third_party/seccomp/seccomp.bzl
@@ -14,8 +14,8 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 genrule(
     name = "config-h",
diff --git a/third_party/urcu/urcu.bzl b/third_party/urcu/urcu.bzl
index 3dfb0f8..57307f1 100644
--- a/third_party/urcu/urcu.bzl
+++ b/third_party/urcu/urcu.bzl
@@ -1,10 +1,10 @@
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 template_file(
     name = "config.h",
     src = "@@//third_party/urcu:config.h.in",
-    substitutions = { },
+    substitutions = {},
 )
 
 cc_library(
diff --git a/third_party/util-linux/util-linux.bzl b/third_party/util-linux/util-linux.bzl
index b0ebca6..36e5886 100644
--- a/third_party/util-linux/util-linux.bzl
+++ b/third_party/util-linux/util-linux.bzl
@@ -14,8 +14,8 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 # These are only for the headers of libcommon, which is a private dependency of libblkid and
 # libuuid. Bazel doesn't support private dependencies and we want to avoid propagating these up
diff --git a/third_party/xfsprogs/xfsprogs.bzl b/third_party/xfsprogs/xfsprogs.bzl
index 6a2b56f..07f3da7 100644
--- a/third_party/xfsprogs/xfsprogs.bzl
+++ b/third_party/xfsprogs/xfsprogs.bzl
@@ -15,7 +15,6 @@
 #  limitations under the License.
 
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
-load("@@//build/utils:template_file.bzl", "template_file")
 
 defs = [
     "NDEBUG",  # Doesn't compile without it because their assertions reference non-existent fields
diff --git a/version/defs.bzl b/version/defs.bzl
index d0e439b..671bc54 100644
--- a/version/defs.bzl
+++ b/version/defs.bzl
@@ -1,8 +1,6 @@
 load(
     "@io_bazel_rules_go//go:def.bzl",
-    "GoLibrary",
     "go_context",
-    "go_library",
 )
 
 def _go_version_library_impl(ctx):
@@ -61,7 +59,7 @@
         ),
         "_genversion": attr.label(
             default = Label("//version/stampgo"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/version/spec/BUILD.bazel b/version/spec/BUILD.bazel
index 7bdb7a0..949b663 100644
--- a/version/spec/BUILD.bazel
+++ b/version/spec/BUILD.bazel
@@ -1,6 +1,6 @@
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "spec_proto",