diff --git a/third_party/nix/env.nix b/third_party/nix/env.nix
index c293036..2af72ff 100644
--- a/third_party/nix/env.nix
+++ b/third_party/nix/env.nix
@@ -40,8 +40,8 @@
     (stdenv.mkDerivation {
       name = "bazel";
       src = builtins.fetchurl {
-        url = https://github.com/bazelbuild/bazel/releases/download/5.4.0/bazel-5.4.0-linux-x86_64;
-        sha256 = "1w58m1brwjfwsv48fmd66inry67m4vgb3bwvwmamhdv099v183jg";
+        url = "https://github.com/bazelbuild/bazel/releases/download/6.4.0/bazel-6.4.0-linux-x86_64";
+        sha256 = "11md3cm9pb1449c3i89xy474v1lmzng5vbw6nhbigqx6xxqg7r3r";
       };
       unpackPhase = ''
         true
@@ -81,7 +81,7 @@
     curl
     gcc
     binutils
-    openjdk11
+    openjdk21
     patch
     python3
     busybox
diff --git a/third_party/nix/sources.json b/third_party/nix/sources.json
index 0e9dd95..56298c3 100644
--- a/third_party/nix/sources.json
+++ b/third_party/nix/sources.json
@@ -1,14 +1,14 @@
 {
     "nixpkgs": {
-        "branch": "release-23.05",
+        "branch": "release-23.11",
         "description": "Nix Packages collection",
         "homepage": null,
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b9fc1843e64c11665ef440d02ecb6b3980a62756",
-        "sha256": "0krzc81cn1vfblhljw9wgx1wkfwlifh9dy3z3c64yhkh3xy6pfji",
+        "rev": "7c8d60d02ba010e1be539c7ec44ebb10354b378b",
+        "sha256": "1j5prrmwxb379bsinh8vbqr99448iz73s9dsv48kc4frwhd05nk2",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/b9fc1843e64c11665ef440d02ecb6b3980a62756.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/7c8d60d02ba010e1be539c7ec44ebb10354b378b.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }
diff --git a/third_party/qemu/patches/bazel_support.patch b/third_party/qemu/patches/bazel_support.patch
index 6489e3a..0856296 100644
--- a/third_party/qemu/patches/bazel_support.patch
+++ b/third_party/qemu/patches/bazel_support.patch
@@ -3,7 +3,7 @@
 index 0000000000..436f8c5cf3
 --- /dev/null
 +++ b/BUILD
-@@ -0,0 +1,1357 @@
+@@ -0,0 +1,1358 @@
 +load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 +load("@rules_python//python:defs.bzl", "py_binary")
 +load("@dev_source_monogon//build/utils:template_file.bzl", "template_file")
@@ -1349,6 +1349,7 @@
 +    name = "keymap-gen",
 +    srcs = [":renamed-keymap-gen"],
 +    visibility = ["//visibility:public"],
++    imports = [""],
 +)
 +
 +genrule(
@@ -1519,7 +1520,7 @@
 index 0000000000..0b4fc8a248
 --- /dev/null
 +++ b/scripts/BUILD
-@@ -0,0 +1,35 @@
+@@ -0,0 +1,38 @@
 +load("@rules_python//python:defs.bzl", "py_binary")
 +
 +py_binary(
@@ -1527,6 +1528,7 @@
 +    srcs = ["qapi-gen.py"],
 +    visibility = ["//visibility:public"],
 +    deps = ["//scripts/qapi"],
++    imports = [""],
 +)
 +
 +py_binary(
@@ -1536,12 +1538,14 @@
 +    main = "tracetool.py",
 +    visibility = ["//visibility:public"],
 +    deps = ["//scripts/tracetool"],
++    imports = [""],
 +)
 +
 +py_binary(
 +    name = "block-coroutine-wrapper",
 +    srcs = ["block-coroutine-wrapper.py"],
 +    visibility = ["//visibility:public"],
++    imports = [""],
 +)
 +
 +sh_binary(
@@ -1560,13 +1564,14 @@
 index 0000000000..99a5ab2243
 --- /dev/null
 +++ b/scripts/modules/BUILD
-@@ -0,0 +1,7 @@
+@@ -0,0 +1,8 @@
 +load("@rules_python//python:defs.bzl", "py_binary")
 +
 +py_binary(
 +    name = "module_block",
 +    srcs = ["module_block.py"],
-+    visibility = ["//:__subpackages__"]
++    visibility = ["//:__subpackages__"],
++    imports = [""],
 +)
 diff --git a/scripts/qapi/BUILD b/scripts/qapi/BUILD
 new file mode 100644