diff --git a/.bazelrc b/.bazelrc
index 938ff6449f..d8b82d91dd 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -27,7 +27,8 @@ build:incompatible --incompatible_enable_cc_toolchain_resolution
 build:incompatible --incompatible_config_setting_private_default_visibility
 build:incompatible --incompatible_enforce_config_setting_visibility
 build:incompatible --incompatible_disallow_empty_glob
+build:incompatible --incompatible_disable_starlark_host_transitions
 # Also enable all incompatible flags in go_bazel_test by default.
 # TODO: Add --incompatible_disallow_empty_glob once
 #  https://github.com/bazelbuild/bazel-gazelle/pull/1405 has been released.
-test:incompatible --test_env=GO_BAZEL_TEST_BAZELFLAGS='--incompatible_load_proto_rules_from_bzl --incompatible_enable_cc_toolchain_resolution --incompatible_config_setting_private_default_visibility --incompatible_enforce_config_setting_visibility'
+test:incompatible --test_env=GO_BAZEL_TEST_BAZELFLAGS='--incompatible_load_proto_rules_from_bzl --incompatible_enable_cc_toolchain_resolution --incompatible_config_setting_private_default_visibility --incompatible_enforce_config_setting_visibility --incompatible_disable_starlark_host_transitions'
diff --git a/WORKSPACE b/WORKSPACE
index cc78d5c2cd..3e894e07ec 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -9,12 +9,12 @@ go_register_toolchains(version = "1.20.2")
 
 http_archive(
     name = "com_google_protobuf",
-    sha256 = "bc3dbf1f09dba1b2eb3f2f70352ee97b9049066c9040ce0c9b67fb3294e91e4b",
-    strip_prefix = "protobuf-3.15.5",
-    # latest, as of 2021-03-08
+    sha256 = "75be42bd736f4df6d702a0e4e4d30de9ee40eac024c4b845d17ae4cc831fe4ae",
+    strip_prefix = "protobuf-21.7",
+    # latest available in BCR, as of 2022-09-30
     urls = [
-        "https://github.com/protocolbuffers/protobuf/archive/v3.15.5.tar.gz",
-        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v3.15.5.tar.gz",
+        "https://github.com/protocolbuffers/protobuf/archive/v21.7.tar.gz",
+        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v21.7.tar.gz",
     ],
 )
 
diff --git a/tests/core/cross/proto_test.go b/tests/core/cross/proto_test.go
index d57a7a3f0e..cd9e6c6058 100644
--- a/tests/core/cross/proto_test.go
+++ b/tests/core/cross/proto_test.go
@@ -26,12 +26,12 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
     name = "com_google_protobuf",
-    sha256 = "a79d19dcdf9139fa4b81206e318e33d245c4c9da1ffed21c87288ed4380426f9",
-    strip_prefix = "protobuf-3.11.4",
-    # latest, as of 2020-02-21
+    sha256 = "75be42bd736f4df6d702a0e4e4d30de9ee40eac024c4b845d17ae4cc831fe4ae",
+    strip_prefix = "protobuf-21.7",
+    # latest available in BCR, as of 2022-09-30
     urls = [
-        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v3.11.4.tar.gz",
-        "https://github.com/protocolbuffers/protobuf/archive/v3.11.4.tar.gz",
+        "https://github.com/protocolbuffers/protobuf/archive/v21.7.tar.gz",
+        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v21.7.tar.gz",
     ],
 )
 
diff --git a/tests/core/transition/hermeticity_test.go b/tests/core/transition/hermeticity_test.go
index 254fefaa08..08eda7d63c 100644
--- a/tests/core/transition/hermeticity_test.go
+++ b/tests/core/transition/hermeticity_test.go
@@ -126,12 +126,12 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
     name = "com_google_protobuf",
-    sha256 = "a79d19dcdf9139fa4b81206e318e33d245c4c9da1ffed21c87288ed4380426f9",
-    strip_prefix = "protobuf-3.11.4",
-    # latest, as of 2020-02-21
+    sha256 = "75be42bd736f4df6d702a0e4e4d30de9ee40eac024c4b845d17ae4cc831fe4ae",
+    strip_prefix = "protobuf-21.7",
+    # latest available in BCR, as of 2022-09-30
     urls = [
-        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v3.11.4.tar.gz",
-        "https://github.com/protocolbuffers/protobuf/archive/v3.11.4.tar.gz",
+        "https://github.com/protocolbuffers/protobuf/archive/v21.7.tar.gz",
+        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v21.7.tar.gz",
     ],
 )