diff --git a/.github/workflows/linux-build.yml b/.github/workflows/linux-build.yml
index 8679085b528b..bed48b9eb580 100644
--- a/.github/workflows/linux-build.yml
+++ b/.github/workflows/linux-build.yml
@@ -59,6 +59,7 @@ jobs:
     env:
       CCACHE_DIR: "/__w/velox/velox/.ccache"
       VELOX_DEPENDENCY_SOURCE: SYSTEM
+      Protobuf_SOURCE: BUNDLED # can be removed after #10134 is merged
       simdjson_SOURCE: BUNDLED
       xsimd_SOURCE: BUNDLED
       CUDA_VERSION: "12.4"
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 365d88d0148f..ee2d15829c45 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -63,17 +63,18 @@ jobs:
         run: |
           brew install \
             bison boost ccache double-conversion flex fmt gflags glog \
-            icu4c libevent libsodium lz4 lzo ninja openssl range-v3 simdjson \
-            snappy thrift xz xsimd zstd
+            icu4c libevent libsodium lz4 lzo ninja openssl protobuf@21 \
+            range-v3 simdjson snappy thrift xz xsimd zstd
 
           echo "NJOBS=`sysctl -n hw.ncpu`" >> $GITHUB_ENV
+          brew unlink protobuf || echo "protobuf not installed"
+          brew link --force protobuf@21
 
       - name: Cache ccache
-        uses: actions/cache@v4
+        uses: assignUser/stash/restore@v1
         with:
           path: '${{ env.CCACHE_DIR }}'
-          key: ccache-macos-${{ matrix.os }}-${{ hashFiles('velox/*') }}
-          restore-keys: ccache-macos-${{ matrix.os }}
+          key: ccache-macos-${{ matrix.os }}
 
       - name: Configure Build
         env:
@@ -92,6 +93,12 @@ jobs:
         run: |
             cmake --build _build/debug -j $NJOBS
             ccache -s
+
+      - uses: assignUser/stash/save@v1
+        with:
+          path: '${{ env.CCACHE_DIR }}'
+          key: ccache-macos-${{ matrix.os }}
+
       - name: Run Tests
         if: false
         run: ctest -j $NJOBS --test-dir _build/debug --output-on-failure
diff --git a/CMake/resolve_dependency_modules/README.md b/CMake/resolve_dependency_modules/README.md
index 46e98dafbbcd..ce766cb17bcd 100644
--- a/CMake/resolve_dependency_modules/README.md
+++ b/CMake/resolve_dependency_modules/README.md
@@ -22,7 +22,7 @@ by Velox. See details on bundling below.
 | xz                | default         | No       |
 | zstd              | default         | No       |
 | openssl           | default         | No       |
-| protobuf          | 21 (exact)      | Yes      |
+| protobuf          | 21.7 >= x < 22  | Yes      |
 | boost             | 1.77.0          | Yes      |
 | flex              | 2.5.13          | No       |
 | bison             | 3.0.4           | No       |
diff --git a/CMake/resolve_dependency_modules/protobuf.cmake b/CMake/resolve_dependency_modules/protobuf.cmake
index f12357a5ff3b..7391f12623ca 100644
--- a/CMake/resolve_dependency_modules/protobuf.cmake
+++ b/CMake/resolve_dependency_modules/protobuf.cmake
@@ -13,9 +13,9 @@
 # limitations under the License.
 include_guard(GLOBAL)
 
-set(VELOX_PROTOBUF_BUILD_VERSION 21.4)
+set(VELOX_PROTOBUF_BUILD_VERSION 21.8)
 set(VELOX_PROTOBUF_BUILD_SHA256_CHECKSUM
-    6c5e1b0788afba4569aeebb2cfe205cb154aa01deacaba0cd26442f3b761a836)
+    83ad4faf95ff9cbece7cb9c56eb3ca9e42c3497b77001840ab616982c6269fb6)
 string(
   CONCAT
     VELOX_PROTOBUF_SOURCE_URL
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 692b4d8d5b25..9c4f3c05ecfa 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -442,7 +442,7 @@ if(${VELOX_BUILD_MINIMAL_WITH_DWIO}
 
   # Locate or build protobuf.
   set_source(Protobuf)
-  resolve_dependency(Protobuf 3.21.4 EXACT)
+  resolve_dependency(Protobuf 3.21.7...<4)
   include_directories(${Protobuf_INCLUDE_DIRS})
 endif()
 
diff --git a/scripts/setup-centos8.sh b/scripts/setup-centos8.sh
index d8b30a071c10..93dfef052dc1 100755
--- a/scripts/setup-centos8.sh
+++ b/scripts/setup-centos8.sh
@@ -123,7 +123,7 @@ function install_fmt {
 }
 
 function install_protobuf {
-  wget_and_untar https://github.com/protocolbuffers/protobuf/releases/download/v21.4/protobuf-all-21.4.tar.gz protobuf
+  wget_and_untar https://github.com/protocolbuffers/protobuf/releases/download/v21.8/protobuf-all-21.8.tar.gz protobuf
   (
     cd protobuf
     ./configure --prefix=/usr