diff --git a/WORKSPACE b/WORKSPACE
index fa23fac..8d22468 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -29,24 +29,22 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
-    # Currently pinned to an unreleased commit for compatibility with pinned Gazelle below.
-    # (we need //go/platforms:{aix,illumos,...} as generated by Gazelle)
+    # Pin slightly above 0.23.0 (and 0.23.1 prerelease at time of writing) to pull in this commit.
+    # This fixes https://github.com/bazelbuild/rules_go/issues/2499, which started manifesting at 0.22.4.
     name = "io_bazel_rules_go",
-    sha256 = "a8045644f4790d8dc7f25d25ee56ed9b7668f609f2aa1c59eef48d2dd9755430",
-    strip_prefix = "rules_go-64f44314a710ce0e3ccc07891cec5f2047901ac8",
+    strip_prefix = "rules_go-c07100d793fc0cdb20bc4f0361c1d53987ba259b",
+    sha256 = "89501e6e6ae6308e82239f0c8e53dceaa428ad8de471a7f8be8b99a1717bb7d8",
     urls = [
-        "https://github.com/bazelbuild/rules_go/archive/64f44314a710ce0e3ccc07891cec5f2047901ac8.tar.gz",
+        "https://github.com/bazelbuild/rules_go/archive/c07100d793fc0cdb20bc4f0361c1d53987ba259b.zip",
     ],
 )
 
 http_archive(
-    # Currently pinned to an unreleased commit that fixes build tag usage in `update-repos`.
-    # This can be unpinned once it makes it into 0.21.0.
     name = "bazel_gazelle",
-    sha256 = "509bb26e377a8ac28ebbd5fb999d15a428b092b0c533dc1e528d66d766ea273e",
-    strip_prefix = "bazel-gazelle-f6ed80dc6ff71e33233006db9584da4cd36a81e6",
+    sha256 = "bfd86b3cbe855d6c16c6fce60d76bd51f5c8dbc9cfcaef7a2bb5c1aafd0710e8",
     urls = [
-        "https://github.com/bazelbuild/bazel-gazelle/archive/f6ed80dc6ff71e33233006db9584da4cd36a81e6.zip",
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.21.0/bazel-gazelle-v0.21.0.tar.gz",
+        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.21.0/bazel-gazellev0.21.0.tar.gz",
     ],
 )