diff --git a/.github/workflows/test_cpp.yml b/.github/workflows/test_cpp.yml
index 763e688295cb..d74e69e19993 100644
--- a/.github/workflows/test_cpp.yml
+++ b/.github/workflows/test_cpp.yml
@@ -45,7 +45,7 @@ jobs:
             cache_key: Bazel7
             image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-cf84e92285ca133b9c8104ad7b14d70e953cbb8e"
             targets: "//src/... //third_party/utf8_range/..."
-          - config: { name: "Bazel7 with Bzlmod", flags: --enable_bzlmod --enable_workspace }
+          - config: { name: "Bazel7 with Bzlmod", flags: --enable_bzlmod --enable_workspace --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 --cxxopt="-Wno-self-assign-overloaded" }
             cache_key: Bazel7bzlmod
             image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-cf84e92285ca133b9c8104ad7b14d70e953cbb8e"
             targets: "//src/... //third_party/utf8_range/..."
diff --git a/MODULE.bazel b/MODULE.bazel
index 55c9195d2806..0df17bbb3f8f 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -30,7 +30,7 @@ bazel_dep(
 
 bazel_dep(
     name = "rules_cc",
-    version = "0.0.9",
+    version = "0.0.13",
 )
 
 bazel_dep(
diff --git a/bazel/private/BUILD b/bazel/private/BUILD
index e800c72bc849..9c24bb1d22c3 100644
--- a/bazel/private/BUILD
+++ b/bazel/private/BUILD
@@ -116,6 +116,7 @@ bzl_library(
         "//bazel/common:proto_common_bzl",
         "//bazel/common:proto_info_bzl",
         "@proto_bazel_features//:features",
+        "@rules_cc//cc:find_cc_toolchain_bzl",
     ],
 )
 
diff --git a/protobuf_deps.bzl b/protobuf_deps.bzl
index 0072327a68bf..bdedeef4cf23 100644
--- a/protobuf_deps.bzl
+++ b/protobuf_deps.bzl
@@ -90,11 +90,11 @@ def protobuf_deps():
         )
 
     if not native.existing_rule("rules_cc"):
-        _github_archive(
+        http_archive(
             name = "rules_cc",
-            repo = "https://github.com/bazelbuild/rules_cc",
-            commit = "c8c38f8c710cbbf834283e4777916b68261b359c",  # 0.0.9
-            sha256 = "5f862a44bbd032e1b48ed53c9c211ba2a1da60e10c5baa01c97369c249299ecb",
+            urls = ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.13/rules_cc-0.0.13.tar.gz"],
+            sha256 = "d9bdd3ec66b6871456ec9c965809f43a0901e692d754885e89293807762d3d80",
+            strip_prefix = "rules_cc-0.0.13",
         )
 
     if not native.existing_rule("rules_java"):