diff --git a/WORKSPACE b/WORKSPACE
index 38ad043..62762e8 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -39,11 +39,11 @@
 
 http_archive(
     name = "bazel_gazelle",
-    sha256 = "222e49f034ca7a1d1231422cdb67066b885819885c356673cb1f72f748a3c9d4",
+    patch_args = ["-p1"],
     patches = [
         "//third_party/gazelle:add-prepatching.patch",
     ],
-    patch_args = ["-p1"],
+    sha256 = "222e49f034ca7a1d1231422cdb67066b885819885c356673cb1f72f748a3c9d4",
     urls = [
         "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.22.3/bazel-gazelle-v0.22.3.tar.gz",
         "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.22.3/bazel-gazelle-v0.22.3.tar.gz",
@@ -51,7 +51,6 @@
 )
 
 load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
-
 load("@bazel_gazelle//:deps.bzl", "go_repository")
 
 # golang.org/x/sys is overridden by the go_rules protobuf dependency -> declare it first, since
@@ -154,9 +153,10 @@
 
 http_archive(
     name = "io_bazel_rules_docker",
-    sha256 = "1698624e878b0607052ae6131aa216d45ebb63871ec497f26c67455b34119c80",
-    strip_prefix = "rules_docker-0.15.0",
-    urls = ["https://github.com/bazelbuild/rules_docker/releases/download/v0.15.0/rules_docker-v0.15.0.tar.gz"],
+    sha256 = "336f711f646974ce51cbd10f0cbaaeac17364d92a9ebbcb88b168088b0df2d58",
+    strip_prefix = "rules_docker-622f9383d2a306840814c2aba8af0e5dae63c44e",
+    # Pinned to a specific commit because of #1675 and #1676 (Bazel 4 compatibility)
+    urls = ["https://github.com/bazelbuild/rules_docker/archive/622f9383d2a306840814c2aba8af0e5dae63c44e.tar.gz"],
 )
 
 load(
@@ -201,4 +201,5 @@
 
 # Load musl toolchain Metropolis sysroot tarball into external repository.
 load("//build/toolchain/musl-host-gcc:sysroot.bzl", "musl_sysroot_repositories")
+
 musl_sysroot_repositories()
diff --git a/build/Dockerfile b/build/Dockerfile
index b893eec..8935d1f 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -37,8 +37,8 @@
 
 # Install Bazel binary
 RUN curl -o /usr/local/bin/bazel \
-	https://releases.bazel.build/3.7.2/release/bazel-3.7.2-linux-x86_64 && \
-	echo '70dc0bee198a4c3d332925a32d464d9036a831977501f66d4996854ad4e4fc0d  /usr/local/bin/bazel' | sha256sum --check && \
+	https://releases.bazel.build/4.0.0/release/bazel-4.0.0-linux-x86_64 && \
+	echo '7bee349a626281fc8b8d04a7a0b0358492712377400ab12533aeb39c2eb2b901  /usr/local/bin/bazel' | sha256sum --check && \
 	chmod +x /usr/local/bin/bazel
 
 # Use a shared Go module cache for gazelle
diff --git a/build/fietsje/deps_kubernetes.go b/build/fietsje/deps_kubernetes.go
index baa7d15..77343cd 100644
--- a/build/fietsje/deps_kubernetes.go
+++ b/build/fietsje/deps_kubernetes.go
@@ -38,6 +38,7 @@
 	).inject(
 		// repo infra, not requested by k8s, but used with bazel
 		"k8s.io/repo-infra", "a3483874bd37251c629c92df6d82a226b0e6ad92",
+		prePatches("k8s-infra-bzl4-compat.patch"),
 	).with(prePatches("k8s-client-go.patch")).use(
 		"k8s.io/client-go",
 	).with(patches("k8s-native-mounter.patch")).use(
diff --git a/build/fietsje/planner.go b/build/fietsje/planner.go
index a609884..d006039 100644
--- a/build/fietsje/planner.go
+++ b/build/fietsje/planner.go
@@ -142,11 +142,14 @@
 // inject adds a dependency to a collection as if requested by the high-level dependency of the collection. This should
 // be used sparingly, for instance when high-level dependencies contain bazel code that uses some external workspaces
 // from Go modules, and those workspaces are not defined in parsed transitive dependency definitions like go.mod/sum.
-func (c *collection) inject(importpath, version string) *collection {
+func (c *collection) inject(importpath, version string, opts ...buildOpt) *collection {
 	d := c.highlevel.child(importpath, version)
 	c.transitive[importpath] = d
 	c.p.available[importpath] = d
 	c.p.enabled[importpath] = true
+	for _, o := range opts {
+		o(c.transitive[importpath])
+	}
 
 	return c
 }
diff --git a/third_party/go/patches/k8s-infra-bzl4-compat.patch b/third_party/go/patches/k8s-infra-bzl4-compat.patch
new file mode 100644
index 0000000..4be0fe8
--- /dev/null
+++ b/third_party/go/patches/k8s-infra-bzl4-compat.patch
@@ -0,0 +1,82 @@
+Copyright 2020 The Monogon Project Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+From 6313aef65ed37aa971737058af391f5be1ae976c Mon Sep 17 00:00:00 2001
+From: Lorenz Brun <lorenz@nexantic.com>
+Date: Wed, 3 Feb 2021 18:11:03 +0100
+Subject: [PATCH] Don't use run_shell with list as cmd
+
+Going upstream at https://github.com/kubernetes/repo-infra/pull/225
+---
+ defs/go.bzl | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/defs/go.bzl b/defs/go.bzl
+index 21cffdd..f4617e1 100644
+--- a/defs/go.bzl
++++ b/defs/go.bzl
+@@ -63,16 +63,7 @@ def _go_genrule_impl(ctx):
+ 
+     srcs = [src for srcs in ctx.attr.srcs for src in srcs.files.to_list()]
+ 
+-    deps = depset(
+-        gopath_files + srcs,
+-        transitive =
+-            # tools
+-            [dep.files for dep in ctx.attr.tools] +
+-            # go toolchain
+-            [depset(go.sdk.libs + go.sdk.srcs + go.sdk.tools + [go.sdk.go])],
+-    )
+-
+-    _, cmd, _ = ctx.resolve_command(
++    inputs, cmd, input_manifests = ctx.resolve_command(
+         command = ctx.attr.cmd,
+         attribute = "cmd",
+         expand_locations = True,
+@@ -83,6 +74,15 @@ def _go_genrule_impl(ctx):
+         tools = ctx.attr.tools,
+     )
+ 
++    deps = depset(
++        gopath_files + srcs + inputs,
++        transitive =
++            # tools
++            [dep.files for dep in ctx.attr.tools] +
++            # go toolchain
++            [depset(go.sdk.libs + go.sdk.srcs + go.sdk.tools + [go.sdk.go])],
++    )
++
+     env = dict()
+     env.update(ctx.configuration.default_shell_env)
+     env.update(go.env)
+@@ -92,11 +92,13 @@ def _go_genrule_impl(ctx):
+         "GOROOT": paths.dirname(go.sdk.root_file.path),
+     })
+ 
+-    ctx.actions.run_shell(
++    ctx.actions.run(
+         inputs = deps,
+         outputs = ctx.outputs.outs,
+         env = env,
+-        command = cmd,
++        executable = cmd[0],
++        arguments = cmd[1:],
++        input_manifests = input_manifests,
+         progress_message = "%s %s" % (ctx.attr.message, ctx),
+         mnemonic = "GoGenrule",
+     )
+-- 
+2.25.1
+
diff --git a/third_party/go/repositories.bzl b/third_party/go/repositories.bzl
index bb58f51..e2b258a 100644
--- a/third_party/go/repositories.bzl
+++ b/third_party/go/repositories.bzl
@@ -2612,6 +2612,10 @@
         importpath = "k8s.io/repo-infra",
         version = "v0.1.4-0.20210105022653-a3483874bd37",
         sum = "h1:0GPavEcPKBA0rYl7f6dO0mXYmx7t9RaXD3be2g23Ps4=",
+        pre_patches = [
+            "//third_party/go/patches:k8s-infra-bzl4-compat.patch",
+        ],
+        patch_args = ["-p1"],
         build_extra_args = [
             "-go_naming_convention=go_default_library",
             "-go_naming_convention_external=go_default_library",