diff --git a/scripts/BUILD b/scripts/BUILD
new file mode 100644
index 0000000..a071996
--- /dev/null
+++ b/scripts/BUILD
@@ -0,0 +1,9 @@
+sh_binary(
+    name = "launch",
+    srcs = ["launch.sh"],
+    data = [
+        "@//:image",
+        "@//:swtpm_data",
+        "@edk2//:firmware",
+    ],
+)
diff --git a/scripts/bazel_copy_generated_for_ide.sh b/scripts/bazel_copy_generated_for_ide.sh
new file mode 100755
index 0000000..66a980f
--- /dev/null
+++ b/scripts/bazel_copy_generated_for_ide.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# Copy generated Go protobuf libraries to a place where a non-Bazel-aware IDE can find them.
+# Locally, a symlink will be sufficient.
+
+cp -r bazel-bin/api/*/linux_amd64_stripped/*/git.monogon.dev/source/smalltown.git/generated/* generated/
diff --git a/scripts/build_artifacts.sh b/scripts/build_artifacts.sh
deleted file mode 100755
index de1addc..0000000
--- a/scripts/build_artifacts.sh
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/usr/bin/env bash
-set -eo pipefail
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-ROOT=$(realpath ${DIR}/../.vendor)
-
-echo "Vendor build root: $ROOT"
-
-if [ ! -d "$ROOT/linux" ] ; then
-    echo "Please first call scripts/fetch_third_party.sh"
-    exit 1
-fi
-
-if [ ! -d "$ROOT/edk2" ] ; then
-    git clone --single-branch --branch edk2-stable201908 --depth=1 --recurse-submodules https://github.com/tianocore/edk2 $ROOT/edk2
-fi
-
-(
-  cd $ROOT/edk2
-  . edksetup.sh
-  make -C BaseTools/Source/C
-  build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -t GCC5 -a X64 -b RELEASE -p $PWD/OvmfPkg/OvmfPkgX64.dsc
-
-  cp Build/OvmfX64/RELEASE_GCC5/FV/{OVMF_CODE.fd,OVMF_VARS.fd} $ROOT/../.artifacts
-)
-
-musl_prefix=$ROOT/musl-prefix
-
-(
-  cd $ROOT/linux
-  make headers_install ARCH=x86_64 INSTALL_HDR_PATH=$musl_prefix
-)
-
-mkdir -p $ROOT/musl
-curl -L https://www.musl-libc.org/releases/musl-1.1.23.tar.gz | tar -xzf - -C $ROOT/musl --strip-components 1
-
-(
-  cd $ROOT/musl
-
-  ./configure --prefix=$musl_prefix --syslibdir=$musl_prefix/lib
-  make -j8
-  make install
-)
-
-mkdir -p $ROOT/util-linux
-curl -L https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/snapshot/util-linux-2.34.tar.gz | tar -xzf - -C $ROOT/util-linux --strip-components 1
-
-(
-  cd $ROOT/util-linux
-  ./autogen.sh
-  ./configure \
-    CC=$musl_prefix/bin/musl-gcc \
-    --without-systemd \
-    --without-udev \
-    --without-btrfs \
-    --disable-pylibmount \
-    --without-tinfo \
-    --prefix=$musl_prefix \
-    --disable-makeinstall-chown \
-    --disable-makeinstall-setuid \
-    --with-bashcompletiondir=$musl_prefix/usr/share/bash-completion
-  make -j8
-  make install
-)
-
-mkdir -p $ROOT/xfsprogs-dev
-curl -L https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/snapshot/xfsprogs-dev-5.2.1.tar.gz | tar -xzf - -C $ROOT/xfsprogs-dev --strip-components 1
-
-(
-  cd $ROOT/xfsprogs-dev
-  patch -p1 < ../../patches/xfsprogs-dev/*.patch
-  make configure
-  ./configure CC=$musl_prefix/bin/musl-gcc "CFLAGS=-static -I$musl_prefix/include -L$musl_prefix/lib" "LDFLAGS=-L$musl_prefix/lib"
-  make -j8 mkfs
-  cp $ROOT/xfsprogs-dev/mkfs/mkfs.xfs $ROOT/../.artifacts
-)
diff --git a/scripts/fetch_third_party.sh b/scripts/fetch_third_party.sh
deleted file mode 100755
index 537b19a..0000000
--- a/scripts/fetch_third_party.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-mkdir -p .vendor/linux
-curl -L https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.19.72.tar.xz | tar -xJf - -C .vendor/linux --strip-components 1
-ln -rfs kernel/linux-smalltown.config .vendor/linux/.config
diff --git a/scripts/gazelle.sh b/scripts/gazelle.sh
new file mode 100755
index 0000000..c47241e
--- /dev/null
+++ b/scripts/gazelle.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# gazelle.sh regenerates BUILD.bazel files for Go source files.
+
+bazelisk run //:gazelle -- update
+bazelisk run //:gazelle -- update-repos -from_file=go.mod -to_macro=repositories.bzl%go_repositories
diff --git a/scripts/launch.sh b/scripts/launch.sh
index aad121f..4704272 100755
--- a/scripts/launch.sh
+++ b/scripts/launch.sh
@@ -1,18 +1,18 @@
 #!/bin/sh
 
-swtpm socket --tpmstate dir=$PWD/.data/tpm --ctrl type=unixio,path=$PWD/.data/swtpm-sock --tpm2 &
+swtpm socket --tpmstate dir=tpm --ctrl type=unixio,path=tpm-socket --tpm2 &
 
 qemu-system-x86_64 \
     -cpu host -smp sockets=1,cpus=1,cores=2,threads=2,maxcpus=4 -m 1024 -machine q35 -enable-kvm -nographic -nodefaults \
-    -drive if=pflash,format=raw,readonly,file=$PWD/.artifacts/OVMF_CODE.fd \
-    -drive if=pflash,format=raw,snapshot=on,file=$PWD/.artifacts/OVMF_VARS.fd \
-    -drive if=virtio,format=raw,cache=unsafe,file=$PWD/.data/smalltown.img \
+    -drive if=pflash,format=raw,readonly,file=external/edk2/OVMF_CODE.fd \
+    -drive if=pflash,format=raw,snapshot=on,file=external/edk2/OVMF_VARS.fd \
+    -drive if=virtio,format=raw,cache=unsafe,file=smalltown.img \
     -netdev user,id=net0,hostfwd=tcp::7833-:7833,hostfwd=tcp::7834-:7834 \
     -device virtio-net-pci,netdev=net0 \
-    -chardev socket,id=chrtpm,path=$PWD/.data/swtpm-sock \
+    -chardev socket,id=chrtpm,path=tpm-socket \
     -tpmdev emulator,id=tpm0,chardev=chrtpm \
     -device tpm-tis,tpmdev=tpm0 \
-    -debugcon file:.data/debug.log \
+    -debugcon file:debug.log \
     -global isa-debugcon.iobase=0x402 \
     -device ipmi-bmc-sim,id=ipmi0 \
     -device virtio-rng-pci \