diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 630638ee80..7e9fda7cfc 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -18,12 +18,14 @@ buildifier:
   # Use a specific version to avoid skew issues when new versions are released.
   version: 8.2.1
   warnings: "all"
-# NOTE: Minimum supported version is 7.x
+# NOTE: Minimum supported version is 8.x
 .minimum_supported_version: &minimum_supported_version
   # For testing minimum supported version.
   # NOTE: Keep in sync with //:version.bzl
-  bazel: 7.x
-  skip_in_bazel_downstream_pipeline: "Bazel 7 required"
+  bazel: 8.x
+  skip_in_bazel_downstream_pipeline: "Bazel 8 required"
+.latest_supported_bazel: &latest_supported_bazel
+  baze: 9.x
 .reusable_config: &reusable_config
   build_targets:
     - "--"
@@ -43,9 +45,11 @@ buildifier:
 .common_workspace_flags_min_bazel: &common_workspace_flags_min_bazel
   build_flags:
     - "--noenable_bzlmod"
+    - "--enable_workspace"
     - "--build_tag_filters=-integration-test"
   test_flags:
     - "--noenable_bzlmod"
+    - "--enable_workspace"
     - "--test_tag_filters=-integration-test"
 .common_workspace_flags: &common_workspace_flags
   skip_in_bazel_downstream_pipeline: "Bazel 9 doesn't support workspace"
@@ -57,7 +61,7 @@ buildifier:
     - "--noenable_bzlmod"
     - "--enable_workspace"
     - "--build_tag_filters=-integration-test"
-  bazel: 7.x
+  bazel: 8.x
 # NOTE: The Mac and Windows bazelinbazel jobs override parts of this config.
 .common_bazelinbazel_config: &common_bazelinbazel_config
     build_flags:
@@ -118,7 +122,7 @@ matrix:
     - debian11
     - macos_arm64
     - windows
-  bazel: [7.*, 8.*, 9.*]
+  bazel: [8.*, 9.*]
 
 tasks:
   # Keep in sync with .bcr/presubmit.yml
@@ -184,30 +188,30 @@ tasks:
     <<: *reusable_config
     name: "Default: Ubuntu, bzlmod, minimum Bazel"
     platform: ubuntu2204
-    bazel: 7.x
+    bazel: 8.x
   ubuntu:
     <<: *reusable_config
     name: "Default: Ubuntu"
     platform: ubuntu2204
-  ubuntu_upcoming:
+  ubuntu_latest:
     <<: *reusable_config
-    name: "Default: Ubuntu, upcoming Bazel"
+    <<: *latest_supported_bazel
+    name: "Default: Ubuntu, latest Bazel"
     platform: ubuntu2204
-    bazel: last_rc
-  ubuntu_rolling:
-    name: "Default: Ubuntu, rolling Bazel"
-    platform: ubuntu2204
-    bazel: rolling
-    # This is an advisory job; doesn't block merges
-    soft_fail:
-      - exit_status: 1
-      - exit_status: 3
-    test_targets:
-      - "--"
-      - "//tests/..."
-    test_flags:
-      - "--keep_going"
-      - "--test_tag_filters=-integration-test"
+  # ubuntu_rolling:
+  #   name: "Default: Ubuntu, rolling Bazel"
+  #   platform: ubuntu2204
+  #   bazel: rolling
+  #   # This is an advisory job; doesn't block merges
+  #   soft_fail:
+  #     - exit_status: 1
+  #     - exit_status: 3
+  #   test_targets:
+  #     - "--"
+  #     - "//tests/..."
+  #   test_flags:
+  #     - "--keep_going"
+  #     - "--test_tag_filters=-integration-test"
   ubuntu_workspace:
     <<: *reusable_config
     <<: *common_workspace_flags
@@ -281,8 +285,6 @@ tasks:
     <<: *reusable_config
     name: "RBE: Ubuntu"
     platform: rbe_ubuntu2204
-    # TODO @aignas 2024-12-11: get the RBE working in CI for bazel 8.0
-    # See https://github.com/bazelbuild/rules_python/issues/2499
     bazel: 8.x
     test_flags:
       - "--test_tag_filters=-integration-test,-acceptance-test"
@@ -372,7 +374,7 @@ tasks:
     name: "examples/pip_parse: Ubuntu, bzlmod, minimum supported Bazel version"
     working_directory: examples/pip_parse
     platform: ubuntu2204
-    bazel: 7.x
+    bazel: 8.x
   integration_test_pip_parse_ubuntu:
     <<: *reusable_build_test_all
     name: "examples/pip_parse: Ubuntu"
@@ -561,7 +563,7 @@ tasks:
     name: "compile_pip_requirements_test_from_external_repo: Ubuntu, bzlmod, minimum Bazel"
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
     platform: ubuntu2204
-    bazel: 7.x
+    bazel: 8.x
     shell_commands:
     # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
diff --git a/.bcr/gazelle/presubmit.yml b/.bcr/gazelle/presubmit.yml
index 99647cac6f..68705b2019 100644
--- a/.bcr/gazelle/presubmit.yml
+++ b/.bcr/gazelle/presubmit.yml
@@ -20,7 +20,7 @@ bcr_test_module:
       "macos",
       "ubuntu2204",
     ]
-    bazel: [7.*, 8.*, 9.*]
+    bazel: [8.*, 9.*]
   tasks:
     run_tests:
       name: "Run test module"
diff --git a/.bcr/presubmit.yml b/.bcr/presubmit.yml
index 1ad61c7f5a..e1af426b84 100644
--- a/.bcr/presubmit.yml
+++ b/.bcr/presubmit.yml
@@ -16,7 +16,7 @@ bcr_test_module:
   module_path: "examples/bzlmod"
   matrix:
     platform: ["debian11", "macos", "ubuntu2204", "windows"]
-    bazel: [7.*, 8.*, 9.*]
+    bazel: [8.*, 9.*]
   tasks:
     run_tests:
       name: "Run test module"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c172b148ec..18c935386b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -54,7 +54,7 @@ END_UNRELEASED_TEMPLATE
 
 {#v0-0-0-removed}
 ### Removed
-* Nothing removed.
+* Bazel 7 is not supported or tested with.
 
 {#v0-0-0-changed}
 ### Changed
diff --git a/MODULE.bazel b/MODULE.bazel
index 326bb5b78e..03a135b403 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -356,7 +356,6 @@ bazel_binaries.local(
     name = "self",
     path = "tests/integration/bazel_from_env",
 )
-bazel_binaries.download(version = "7.7.0")
 bazel_binaries.download(version = "8.5.1")
 bazel_binaries.download(version = "9.0.0rc1")
 use_repo(
@@ -365,7 +364,6 @@ use_repo(
     # These don't appear necessary, but are reported as direct dependencies
     # that should be use_repo()'d, so we add them as requested
     "bazel_binaries_bazelisk",
-    "build_bazel_bazel_7_7_0",
     "build_bazel_bazel_8_5_1",
     "build_bazel_bazel_9_0_0rc1",
     # "build_bazel_bazel_rolling",
diff --git a/examples/build_file_generation/WORKSPACE b/examples/build_file_generation/WORKSPACE
index 27d0d13b7c..9a352b8437 100644
--- a/examples/build_file_generation/WORKSPACE
+++ b/examples/build_file_generation/WORKSPACE
@@ -132,3 +132,9 @@ load("@rules_python_gazelle_plugin//:deps.bzl", _py_gazelle_deps = "gazelle_deps
 # This rule loads and compiles various go dependencies that running gazelle
 # for python requirements.
 _py_gazelle_deps()
+
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+
+rules_shell_toolchains()
diff --git a/examples/pip_repository_annotations/WORKSPACE b/examples/pip_repository_annotations/WORKSPACE
index 8540555084..78fdae3560 100644
--- a/examples/pip_repository_annotations/WORKSPACE
+++ b/examples/pip_repository_annotations/WORKSPACE
@@ -60,3 +60,18 @@ pip_parse(
 load("@pip//:requirements.bzl", "install_deps")
 
 install_deps()
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rules_shell",
+    sha256 = "410e8ff32e018b9efd2743507e7595c26e2628567c42224411ff533b57d27c28",
+    strip_prefix = "rules_shell-0.2.0",
+    url = "https://github.com/bazelbuild/rules_shell/releases/download/v0.2.0/rules_shell-v0.2.0.tar.gz",
+)
+
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+
+rules_shell_toolchains()
diff --git a/tests/bootstrap_impls/BUILD.bazel b/tests/bootstrap_impls/BUILD.bazel
index ab3148db00..00e5dfe2ac 100644
--- a/tests/bootstrap_impls/BUILD.bazel
+++ b/tests/bootstrap_impls/BUILD.bazel
@@ -14,6 +14,7 @@
 load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load("//python:py_test.bzl", "py_test")
+load("//python/private:reexports.bzl", "BuiltinPyInfo")  # buildifier: disable=bzl-visibility
 load("//tests/support:py_reconfig.bzl", "py_reconfig_binary", "py_reconfig_test")
 load("//tests/support:sh_py_run_test.bzl", "sh_py_run_test")
 load("//tests/support:support.bzl", "SUPPORTS_BOOTSTRAP_SCRIPT")
@@ -112,6 +113,7 @@ py_reconfig_test(
     # Necessary because bazel_tools doesn't have __init__.py files.
     legacy_create_init = True,
     main = "bazel_tools_importable_test.py",
+    target_compatible_with = [] if BuiltinPyInfo else ["@platforms//:incompatible"],
     deps = [
         "@bazel_tools//tools/python/runfiles",
     ],
diff --git a/tests/integration/compile_pip_requirements/.bazelrc b/tests/integration/compile_pip_requirements/.bazelrc
index b85f03bcb6..8a42e6405b 100644
--- a/tests/integration/compile_pip_requirements/.bazelrc
+++ b/tests/integration/compile_pip_requirements/.bazelrc
@@ -2,4 +2,3 @@ test --test_output=errors
 
 # Windows requires these for multi-python support:
 build --enable_runfiles
-common:bazel7.x --incompatible_python_disallow_native_rules
diff --git a/tests/integration/compile_pip_requirements_test_from_external_repo/.bazelrc b/tests/integration/compile_pip_requirements_test_from_external_repo/.bazelrc
index ab10c8caf7..b98fc09774 100644
--- a/tests/integration/compile_pip_requirements_test_from_external_repo/.bazelrc
+++ b/tests/integration/compile_pip_requirements_test_from_external_repo/.bazelrc
@@ -1,2 +1 @@
 test --test_output=errors
-common:bazel7.x --incompatible_python_disallow_native_rules
diff --git a/tests/integration/local_toolchains/.bazelrc b/tests/integration/local_toolchains/.bazelrc
index aed08b0790..4cedadd752 100644
--- a/tests/integration/local_toolchains/.bazelrc
+++ b/tests/integration/local_toolchains/.bazelrc
@@ -3,6 +3,5 @@ common --lockfile_mode=off
 test --test_output=errors
 # Windows requires these for multi-python support:
 build --enable_runfiles
-common:bazel7.x --incompatible_python_disallow_native_rules
 build --//:py=local
 common --announce_rc
diff --git a/tests/integration/pip_parse/.bazelrc b/tests/integration/pip_parse/.bazelrc
index a74909297d..bd29865b95 100644
--- a/tests/integration/pip_parse/.bazelrc
+++ b/tests/integration/pip_parse/.bazelrc
@@ -4,5 +4,3 @@ build --enable_runfiles
 
 # https://docs.bazel.build/versions/main/best-practices.html#using-the-bazelrc-file
 try-import %workspace%/user.bazelrc
-
-common:bazel7.x --incompatible_python_disallow_native_rules
diff --git a/tests/integration/py_cc_toolchain_registered/.bazelrc b/tests/integration/py_cc_toolchain_registered/.bazelrc
index fb31561892..741d758a4f 100644
--- a/tests/integration/py_cc_toolchain_registered/.bazelrc
+++ b/tests/integration/py_cc_toolchain_registered/.bazelrc
@@ -1,3 +1,2 @@
 # This aids debugging on failure
 build --toolchain_resolution_debug=python
-common:bazel7.x --incompatible_python_disallow_native_rules