diff --git a/WORKSPACE b/WORKSPACE
index fa23fac..8d22468 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -29,24 +29,22 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
-    # Currently pinned to an unreleased commit for compatibility with pinned Gazelle below.
-    # (we need //go/platforms:{aix,illumos,...} as generated by Gazelle)
+    # Pin slightly above 0.23.0 (and 0.23.1 prerelease at time of writing) to pull in this commit.
+    # This fixes https://github.com/bazelbuild/rules_go/issues/2499, which started manifesting at 0.22.4.
     name = "io_bazel_rules_go",
-    sha256 = "a8045644f4790d8dc7f25d25ee56ed9b7668f609f2aa1c59eef48d2dd9755430",
-    strip_prefix = "rules_go-64f44314a710ce0e3ccc07891cec5f2047901ac8",
+    strip_prefix = "rules_go-c07100d793fc0cdb20bc4f0361c1d53987ba259b",
+    sha256 = "89501e6e6ae6308e82239f0c8e53dceaa428ad8de471a7f8be8b99a1717bb7d8",
     urls = [
-        "https://github.com/bazelbuild/rules_go/archive/64f44314a710ce0e3ccc07891cec5f2047901ac8.tar.gz",
+        "https://github.com/bazelbuild/rules_go/archive/c07100d793fc0cdb20bc4f0361c1d53987ba259b.zip",
     ],
 )
 
 http_archive(
-    # Currently pinned to an unreleased commit that fixes build tag usage in `update-repos`.
-    # This can be unpinned once it makes it into 0.21.0.
     name = "bazel_gazelle",
-    sha256 = "509bb26e377a8ac28ebbd5fb999d15a428b092b0c533dc1e528d66d766ea273e",
-    strip_prefix = "bazel-gazelle-f6ed80dc6ff71e33233006db9584da4cd36a81e6",
+    sha256 = "bfd86b3cbe855d6c16c6fce60d76bd51f5c8dbc9cfcaef7a2bb5c1aafd0710e8",
     urls = [
-        "https://github.com/bazelbuild/bazel-gazelle/archive/f6ed80dc6ff71e33233006db9584da4cd36a81e6.zip",
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.21.0/bazel-gazelle-v0.21.0.tar.gz",
+        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.21.0/bazel-gazellev0.21.0.tar.gz",
     ],
 )
 
diff --git a/core/scripts/test_boot.sh b/core/scripts/test_boot.sh
index 4a5dead..36ab079 100755
--- a/core/scripts/test_boot.sh
+++ b/core/scripts/test_boot.sh
@@ -7,7 +7,7 @@
 # have to worry about cross-compilation or varying build environments.
 #
 # (see https://github.com/bazelbuild/bazel/blob/master/tools/bash/runfiles/runfiles.bash)
-set kubectl_path "external/io_k8s_kubernetes/cmd/kubectl/linux_amd64_pure_stripped/kubectl"
+set kubectl_path "external/io_k8s_kubernetes/cmd/kubectl/kubectl_/kubectl"
 
 set timeout 120
 
diff --git a/nogo_config.json b/nogo_config.json
index 1170f0c..53aeb6f 100644
--- a/nogo_config.json
+++ b/nogo_config.json
@@ -21,7 +21,8 @@
       "external/com_github_google_gvisor/": "third_party",
       "external/io_k8s_sigs_structured_merge_diff/": "third_party",
       "external/io_k8s_component_base/": "third_party",
-      "external/io_k8s_apiserver/": "third_party"
+      "external/io_k8s_apiserver/": "third_party",
+      "external/org_golang_google_protobuf/": "third_party"
     }
   },
   "lostcancel": {
@@ -38,7 +39,8 @@
       "external/bazel_gazelle/pathtools": "third_party",
       "external/com_github_magiconair_properties": "third_party",
       "external/com_github_ghodss_yaml": "third_party",
-      "external/io_k8s_kubectl": "third_party"
+      "external/io_k8s_kubectl": "third_party",
+      "external/org_golang_google_protobuf/": "third_party"
     }
   },
   "assign": {