diff --git a/.bazelrc b/.bazelrc
index cfeb312..d4e676e 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -57,6 +57,15 @@
 # Enable resource set configuration via starlark for actions
 build --experimental_action_resource_set
 
+# Stop propagation of settings to exec config by default.
+# See https://github.com/bazelbuild/bazel/issues/22457
+build --experimental_exclude_starlark_flags_from_exec_config
+# These flags need to be propagated for nogo to work. We currently need to
+# reference rules_go with the canonical repo name; this is no longer necessary
+# once the fix for https://github.com/bazelbuild/bazel/issues/25208 is released.
+build --experimental_propagate_custom_flag=@@rules_go+//go/private:request_nogo
+build --experimental_propagate_custom_flag=@@rules_go+//go/private:bootstrap_nogo
+
 # Hardwire all action envs to just use /usr/bin from the above sandbox. This is
 # necessary on NixOS Bazel builds, as they really like to inject /nix/store/*
 # paths otherwise. We also explicitly set it to /usr/bin only (no /bin) as
diff --git a/MODULE.bazel b/MODULE.bazel
index 4d8e1df..588fe0d 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -98,8 +98,6 @@
 register_toolchains("@rust_toolchains//:all")
 
 # Protobuf Toolchains
-register_toolchains("//build/toolchain/protobuf:protoc_sources_toolchain")
-
 register_toolchains("@rules_rust_protobuf//:default_proto_toolchain")
 
 register_toolchains("//build/toolchain/rust-efi:prost_efi_toolchain")
diff --git a/build/toolchain/protobuf/BUILD.bazel b/build/toolchain/protobuf/BUILD.bazel
deleted file mode 100644
index 19caf61..0000000
--- a/build/toolchain/protobuf/BUILD.bazel
+++ /dev/null
@@ -1,17 +0,0 @@
-load("@protobuf//bazel/toolchains:proto_toolchain.bzl", "proto_toolchain")
-load(":def.bzl", "ignore_unused_configuration_target")
-
-ignore_unused_configuration_target(
-    name = "protoc",
-    dep = "@protobuf//:protoc",
-    visibility = ["//visibility:private"],
-)
-
-# This is a copy of the toolchain defined at
-# @protobuf//bazel/private/toolchains:protoc_sources_toolchain, but with unused
-# configurations reset, such that we build protoc only once.
-proto_toolchain(
-    name = "protoc_sources",
-    exec_compatible_with = [],
-    proto_compiler = ":protoc",
-)
diff --git a/build/toolchain/protobuf/def.bzl b/build/toolchain/protobuf/def.bzl
deleted file mode 100644
index ea6a9b5..0000000
--- a/build/toolchain/protobuf/def.bzl
+++ /dev/null
@@ -1,34 +0,0 @@
-load("//osbase/build:def.bzl", "forward_impl")
-
-# This is a copy of ignore_unused_configuration_target from
-# //osbase/build:def.bzl with specific settings for the protobuf toolchain.
-_new_settings = {
-    "@io_bazel_rules_go//go/config:race": False,
-    "@io_bazel_rules_go//go/config:pure": False,
-    "@io_bazel_rules_go//go/config:static": False,
-    "@io_bazel_rules_go//go/config:tags": [],
-
-    # These private configs show up because of a bug in rules_go, which is
-    # missing a non_go_tool_transition on the proto toolchain when
-    # --incompatible_enable_proto_toolchain_resolution is enabled.
-    "@io_bazel_rules_go//go/private/rules:original_pure": "",
-    "@io_bazel_rules_go//go/private/rules:original_tags": "",
-}
-
-def _ignore_unused_configuration_impl(_settings, _attr):
-    return _new_settings
-
-_ignore_unused_configuration = transition(
-    implementation = _ignore_unused_configuration_impl,
-    inputs = [],
-    outputs = list(_new_settings.keys()),
-)
-
-ignore_unused_configuration_target = rule(
-    cfg = _ignore_unused_configuration,
-    implementation = forward_impl,
-    attrs = {
-        "dep": attr.label(mandatory = True),
-    },
-    doc = """Applies ignore_unused_configuration transition to a target.""",
-)