diff --git a/sdk/.bazeliskrc b/sdk/.bazeliskrc
deleted file mode 100644
index 16c346d541a5..000000000000
--- a/sdk/.bazeliskrc
+++ /dev/null
@@ -1 +0,0 @@
-USE_BAZEL_VERSION=7.1.0
diff --git a/sdk/.bazelrc b/sdk/.bazelrc
index 5d922f7caddb..3787452d079b 100644
--- a/sdk/.bazelrc
+++ b/sdk/.bazelrc
@@ -1,4 +1,5 @@
-common --noenable_bzlmod
+common --enable_bzlmod
+common --noenable_workspace
 
 # Bazel distributed cache, can be temporarily disabled by passing the following
 # flag: --noremote_accept_cached
@@ -23,9 +24,9 @@ sync:darwin --repository_cache=.bazel-cache/repo
 
 test:oracle --repo_env DAML_ORACLE_TESTING=true --test_env ORACLE_USERNAME --test_env ORACLE_PORT --test_env ORACLE_PWD
 
-# set c++ compilation version to 14 (requiered for abseil)
-build --cxxopt=-std=c++14
-build --host_cxxopt=-std=c++14
+# set c++ compilation version to 14 (requiered for abseil) -> 17 for new version
+build --cxxopt=-std=c++17
+build --host_cxxopt=-std=c++17
 
 # Improve remote cache hit rate by exluding environment variables from the
 # sandbox that are not whitelisted using --action_env.
@@ -68,15 +69,21 @@ test --strategy=Scalac=worker
 #  https://github.com/grpc/grpc/pull/13929/files
 build --copt -DGRPC_BAZEL_BUILD
 
+# build --java_language_version=17
+# build:linux --java_runtime_version=nixpkgs_java_17
+# build:linux --tool_java_runtime_version=nixpkgs_java_17
+# build:darwin --java_runtime_version=nixpkgs_java_17
+# build:darwin --tool_java_runtime_version=nixpkgs_java_17
+# build:windows --java_runtime_version=17
+# build:windows --tool_java_runtime_version=17
+# build --tool_java_language_version=17
+
 build --java_language_version=17
-build:linux --java_runtime_version=nixpkgs_java_17
-build:linux --tool_java_runtime_version=nixpkgs_java_17
-build:darwin --java_runtime_version=nixpkgs_java_17
-build:darwin --tool_java_runtime_version=nixpkgs_java_17
-build:windows --java_runtime_version=17
-build:windows --tool_java_runtime_version=17
 build --tool_java_language_version=17
 
+build --java_runtime_version=remotejdk_17
+build --tool_java_runtime_version=remotejdk_17
+
 # Propagate locales and the java home to the test environment.
 build --test_env=LANG=en_US.utf8 --test_env=LOCALE_ARCHIVE --test_env=JAVA_HOME
 
@@ -104,6 +111,9 @@ build:windows --crosstool_top=@rules_haskell_ghc_windows_amd64//:cc_toolchain
 build:windows --remote_accept_cached=true
 build:windows --jobs=4
 
+build --action_env=CC=/usr/bin/gcc-14
+build --action_env=CXX=/usr/bin/g++-14
+
 # Instruct bazel to globally use this flag for compiling protobuf files.
 # We need the source info for generating proto docs. By default proto_library strips
 # source information and doesn't provide an option to turn this flag on.
diff --git a/sdk/.bazelversion b/sdk/.bazelversion
new file mode 100644
index 000000000000..e28dc5baea54
--- /dev/null
+++ b/sdk/.bazelversion
@@ -0,0 +1 @@
+7.x
\ No newline at end of file
diff --git a/sdk/.gitignore b/sdk/.gitignore
index 94191ae32ca7..d4a7676af845 100644
--- a/sdk/.gitignore
+++ b/sdk/.gitignore
@@ -1,3 +1,8 @@
+# This should be later on unignored, for now it will just make a mess
+# in commit history
+# Refer to: https://bazel.build/external/lockfile#best-practices
+MODULE.bazel.lock
+
 # private configuration
 .envrc.private
 
diff --git a/sdk/.pre-commit-config.yaml b/sdk/.pre-commit-config.yaml
index e8dd6ad8fe56..775d2d4e2a2a 100644
--- a/sdk/.pre-commit-config.yaml
+++ b/sdk/.pre-commit-config.yaml
@@ -30,7 +30,7 @@ repos:
       name: buildifier
       language: system
       require_serial: true
-      entry: "bash -c 'cd sdk/; bazel run //:buildifier-pre-commit -- -mode=fix -v=true'"
+      entry: "bash -c 'cd sdk/; bazel run //:buildifier-fix'"
       types: [bazel]
     - id: pprettier
       name: pprettier
diff --git a/sdk/3rdparty/haskell/BUILD.bazel b/sdk/3rdparty/haskell/BUILD.bazel
index efe9671216b0..bb6777621507 100644
--- a/sdk/3rdparty/haskell/BUILD.bazel
+++ b/sdk/3rdparty/haskell/BUILD.bazel
@@ -7,7 +7,7 @@ genrule(
     name = "remote_apis_src",
     srcs = [
         "@com_github_bazelbuild_remote_apis//build/bazel/remote/execution/v2:remote_execution.proto",
-        "@com_google_protobuf//:well_known_protos",
+        "@protobuf//:well_known_type_protos",
         "@go_googleapis//google/rpc:status.proto",
     ],
     outs = ["Build/Bazel/Remote/Execution/V2/RemoteExecution.hs"],
@@ -16,11 +16,17 @@ genrule(
     PROTO_FILE="$(location @com_github_bazelbuild_remote_apis//build/bazel/remote/execution/v2:remote_execution.proto)"
     PROTO_FILE_NAME="$$(echo "$$PROTO_FILE" | sed 's|^.*\\(build/bazel/.*\\)|\\1|g')"
     PROTO_DIR=$$(echo $${PROTO_FILE%$$PROTO_FILE_NAME})
+    for f in $(locations @protobuf//:well_known_type_protos); do
+        PROTOBUF_INCLUDE=$${f%%/google/protobuf/*}
+        break
+    done
+    RPC_STATUS="$(location @go_googleapis//google/rpc:status.proto)"
+    RPC_INCLUDE=$${RPC_STATUS%%/google/rpc/*}
     $(location @proto3-suite//:compile-proto-file) \
       --proto "$$PROTO_FILE_NAME" \
       --includeDir "$$PROTO_DIR" \
-      --includeDir "external/com_google_protobuf/src" \
-      --includeDir "external/go_googleapis" \
+      --includeDir "$$PROTOBUF_INCLUDE" \
+      --includeDir "$$RPC_INCLUDE" \
       --out $(RULEDIR)
   """,
     tools = [
diff --git a/sdk/BUILD b/sdk/BUILD
index 7f0ab929e6f9..d332cf2c4ed6 100644
--- a/sdk/BUILD
+++ b/sdk/BUILD
@@ -13,6 +13,7 @@ load("//bazel_tools:haskell.bzl", "da_haskell_library", "da_haskell_repl")
 load("//bazel_tools:scala.bzl", "da_scala_library")
 load("@os_info//:os_info.bzl", "is_windows")
 load("@build_environment//:configuration.bzl", "ghc_version", "mvn_version", "sdk_version")
+load("@buildifier_prebuilt//:rules.bzl", "buildifier", "buildifier_test")
 
 exports_files([".hlint.yaml"])
 
@@ -165,42 +166,42 @@ exports_files([
     "maven_install_2.13.json",
 ])
 
-# Buildifier.
-
-load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier")
-
-buildifier_excluded_patterns = [
+_BUILDIFIER_EXCLUDE_PATTERNS = [
     "./3rdparty/haskell/c2hs-package.bzl",
     "./3rdparty/haskell/network-package.bzl",
-    "**/node_modules/*",
+    "./**/node_modules/*",
+]
+
+_BUILDIFIER_WARNINGS = [
+    "+unsorted-dict-items",
+    "+out-of-order-load",
+    "+load",
 ]
 
-# Run this to check if BUILD files are well-formatted.
 buildifier(
     name = "buildifier",
-    exclude_patterns = buildifier_excluded_patterns,
-    mode = "check",
+    exclude_patterns = _BUILDIFIER_EXCLUDE_PATTERNS,
+    lint_mode = "warn",
+    lint_warnings = _BUILDIFIER_WARNINGS,
+    mode = "diff",
+    verbose = True,
 )
 
-# Run this to fix the errors in BUILD files.
 buildifier(
     name = "buildifier-fix",
-    exclude_patterns = buildifier_excluded_patterns,
+    exclude_patterns = _BUILDIFIER_EXCLUDE_PATTERNS,
+    lint_mode = "fix",
+    lint_warnings = _BUILDIFIER_WARNINGS,
     mode = "fix",
     verbose = True,
 )
 
-# Run by the git pre-commit hook
-genrule(
-    name = "buildifier-pre-commit",
-    outs = ["buildifier-hook"],
-    cmd = """cat <<'EOF' > "$@"
-# !/usr/bin/env bash
-exec "$(execpath @com_github_bazelbuild_buildtools//buildifier)" "$$@"
-EOF
-""",
-    executable = True,
-    tools = ["@com_github_bazelbuild_buildtools//buildifier"],
+buildifier_test(
+    name = "buildifier_test",
+    lint_mode = "warn",
+    lint_warnings = _BUILDIFIER_WARNINGS,
+    no_sandbox = True,
+    workspace = "//:MODULE.bazel",
 )
 
 # Default target for da-ghci, da-ghcid.
@@ -231,7 +232,7 @@ da_haskell_repl(
     ],
 )
 
-load("@bazel_gazelle//:def.bzl", "gazelle")
+load("@gazelle//:def.bzl", "gazelle")
 
 gazelle(
     name = "gazelle-update-repos",
diff --git a/sdk/MODULE.bazel b/sdk/MODULE.bazel
new file mode 100644
index 000000000000..6df9e28f89ed
--- /dev/null
+++ b/sdk/MODULE.bazel
@@ -0,0 +1,536 @@
+module(
+    name = "daml-sdk",
+    version = "0.0.0",
+)
+
+bazel_dep(name = "bazel_jar_jar", version = "0.1.14")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
+bazel_dep(name = "buildifier_prebuilt", version = "8.5.1.2", dev_dependency = True)
+bazel_dep(name = "gazelle", version = "0.47.0")
+bazel_dep(name = "google_bazel_common", version = "0.0.1")
+bazel_dep(name = "patchelf", version = "0.18.0.bcr.1")
+bazel_dep(name = "pigz", version = "2.8.bcr.1")
+bazel_dep(name = "protobuf", version = "25.6")
+bazel_dep(name = "rules_cc", version = "0.2.16")
+bazel_dep(name = "rules_go", version = "0.59.0")
+bazel_dep(name = "rules_haskell", version = "0.18")
+bazel_dep(name = "rules_java", version = "9.5.0")
+bazel_dep(name = "rules_jvm_external", version = "6.10")
+bazel_dep(name = "rules_perl", version = "1.1.0")
+bazel_dep(name = "rules_pkg", version = "1.2.0")
+bazel_dep(name = "rules_proto", version = "6.0.0")
+# TODO: Verify if rules_scala can be upgraded past 7.1.2 (last version supporting scala 2.13.16)
+bazel_dep(name = "rules_scala", version = "7.1.2")
+bazel_dep(name = "rules_sh", version = "0.5.0")
+bazel_dep(name = "tar.bzl", version = "0.8.1")
+bazel_dep(name = "zlib", version = "1.3.1.bcr.8")
+
+# --- Toolchains ---
+
+bazel_lib_toolchains_ext = use_extension("@tar.bzl//tar:extensions.bzl", "toolchains")
+use_repo(bazel_lib_toolchains_ext, "bsd_tar_toolchains")
+
+register_toolchains("@bsd_tar_toolchains//:all")
+
+# --- Haskell toolchain and extensions ---
+
+haskell_toolchains_ext = use_extension(
+    "@rules_haskell//extensions:haskell_toolchains.bzl",
+    "haskell_toolchains",
+)
+haskell_toolchains_ext.bindists(version = "9.0.2")
+
+da_ghc_ext = use_extension("//bazel/extensions:da_ghc_extension.bzl", "da_ghc")
+use_repo(da_ghc_ext, "da-ghc", "ghc-lib-gen")
+
+cabal_ext = use_extension("//bazel/extensions:cabal_extension.bzl", "cabal")
+use_repo(cabal_ext, "cabal")
+
+ghcide_lib_ext = use_extension("//bazel/extensions:ghcide_extension.bzl", "ghcide_lib")
+use_repo(ghcide_lib_ext, "ghcide_lib")
+
+lsp_types_ext = use_extension("//bazel/extensions:lsp_types_extension.bzl", "lsp_types")
+use_repo(lsp_types_ext, "lsp-types")
+
+zip_ext = use_extension("//bazel/extensions:zip_extension.bzl", "zip")
+use_repo(zip_ext, "zip")
+
+# --- Haskell packages (stack_snapshot) ---
+
+stack_snapshot_ext = use_extension(
+    "@rules_haskell//extensions:stack_snapshot.bzl",
+    "stack_snapshot",
+)
+use_repo(stack_snapshot_ext, "stackage", "stackage-exe")
+
+stack_snapshot_ext.snapshot(local_snapshot = "//:stackage_snapshot.yaml")
+
+stack_snapshot_ext.package(
+    name = "lsp-types",
+    vendored = "@lsp-types//:lsp-types",
+)
+HASKELL_PACKAGES = [
+    # Core / GHC base
+    "array",
+    "base",
+    "binary",
+    "bytestring",
+    "containers",
+    "deepseq",
+    "directory",
+    "filepath",
+    "mtl",
+    "pretty",
+    "process",
+    "stm",
+    "text",
+    "time",
+    "transformers",
+    "unix",
+    "unix-compat",
+
+    # Data structures & utilities
+    "data-default",
+    "Decimal",
+    "Diff",
+    "dlist",
+    "either",
+    "extra",
+    "hashable",
+    "mod",
+    "safe",
+    "safe-exceptions",
+    "scientific",
+    "semigroupoids",
+    "some",
+    "split",
+    "tagged",
+    "unordered-containers",
+    "validation",
+    "vector",
+
+    # Concurrency & IO
+    "async",
+    "monad-loops",
+    "resourcet",
+    "typed-process",
+    "unliftio",
+    "unliftio-core",
+
+    # Text processing & parsing
+    "ansi-terminal",
+    "ansi-wl-pprint",
+    "blaze-html",
+    "cmark-gfm",
+    "haskell-src-exts",
+    "megaparsec",
+    "parsec",
+    "parser-combinators",
+    "pcre-utils",
+    "prettyprinter",
+    "recursion-schemes",
+    "regex-tdfa",
+    "rope-utf16-splay",
+    "stache",
+    "syb",
+    "uniplate",
+    "utf8-string",
+
+    # Serialization & encoding
+    "aeson",
+    "aeson-pretty",
+    "base64",
+    "base64-bytestring",
+    "proto3-wire",
+    "xml",
+    "yaml",
+
+    # Networking, HTTP & security
+    "conduit",
+    "conduit-extra",
+    "cryptonite",
+    "http-client",
+    "http-client-tls",
+    "http-conduit",
+    "http-types",
+    "jwt",
+    "memory",
+    "network",
+    "network-uri",
+    "tar-conduit",
+    "tls",
+    "uri-encode",
+
+    # Filesystem & archives
+    "file-embed",
+    "filelock",
+    "filepattern",
+    "temporary",
+    "zip-archive",
+
+    # Optics & CLI
+    "lens",
+    "lens-aeson",
+    "optparse-applicative",
+    "repline",
+    "terminal-progress-bar",
+
+    # Compiler tooling, build & misc
+    "Cabal",
+    "clock",
+    "ghc-lib-parser-ex",
+    "gitrev",
+    "hlint",
+    "hslogger",
+    "lsp",
+    "lsp-test",
+    "random",
+    "random-shuffle",
+    "retry",
+    "semver",
+    "shake",
+    "template-haskell",
+
+    # Testing
+    "QuickCheck",
+    "silently",
+    "tasty",
+    "tasty-golden",
+    "tasty-hunit",
+    "tasty-quickcheck",
+]
+
+[stack_snapshot_ext.package(name = pkg) for pkg in HASKELL_PACKAGES]
+
+stack_snapshot_ext.package(
+    name = "attoparsec",
+    components = [
+        "lib:attoparsec",
+        "lib:attoparsec-internal",
+    ],
+    components_dependencies = {"lib:attoparsec": ["lib:attoparsec-internal"]},
+)
+stack_snapshot_ext.package(
+    name = "ghc-lib",
+    vendored = "//bazel/ghc-lib/ghc-lib",
+)
+stack_snapshot_ext.package(
+    name = "ghc-lib-parser",
+    vendored = "//bazel/ghc-lib/ghc-lib-parser",
+)
+stack_snapshot_ext.package(
+    name = "ghcide",
+    flags = ["ghc-lib"],
+    vendored = "@ghcide_lib//:ghcide",
+)
+stack_snapshot_ext.package(
+    name = "proto3-suite",
+    flags = ["-swagger"],
+    vendored = "@proto3-suite//:proto3-suite",
+)
+stack_snapshot_ext.package(
+    name = "zip",
+    vendored = "@zip//:zip",
+)
+stack_snapshot_ext.package(
+    name = "happy",
+    components = ["exe"],
+)
+stack_snapshot_ext.package(
+    name = "alex",
+    components = ["exe"],
+)
+stack_snapshot_ext.package(
+    name = "hpp",
+    components = [
+        "lib",
+        "exe",
+    ],
+)
+
+# --- Scala configuration ---
+
+scala_config_ext = use_extension(
+    "@rules_scala//scala/extensions:config.bzl",
+    "scala_config",
+)
+scala_config_ext.settings(scala_version = "2.13.16")
+use_repo(scala_config_ext, "rules_scala_config")
+
+scala_deps_ext = use_extension(
+    "@rules_scala//scala/extensions:deps.bzl",
+    "scala_deps",
+)
+scala_deps_ext.scala()
+scala_deps_ext.scalatest()
+use_repo(
+    scala_deps_ext,
+    "io_bazel_rules_scala_scala_compiler",
+    "io_bazel_rules_scala_scala_library",
+    "io_bazel_rules_scala_scala_reflect",
+    "io_bazel_rules_scala_scala_parser_combinators",
+)
+
+# --- Maven version constants ---
+
+CANTON_VERSION = "3.5.0-snapshot.20260225.18149.0.vc28e7872"
+AUTH0_JWT_VERSION = "4.2.1"
+SHAPELESS_VERSION = "2.4.0-M1"
+SCOPT_VERSION = "4.1.0"
+SCALA_LOGGING_VERSION = "3.9.5"
+PROTO_GOOGLE_COMMON_PROTOS_VERSION = "2.59.2"
+JSR305_VERSION = "3.0.2"
+GSON_VERSION = "2.11.0"
+GUAVA_VERSION = "33.3.0-jre"
+PROTOBUF_JAVA_VERSION = "3.25.5"
+GRPC_JAVA_MAVEN_VERSION = "1.77.0"
+OJDBC_VERSION = "19.18.0.0"
+SPARK_CORE_VERSION = "2.9.4"
+JAVAPOET_VERSION = "1.13.0"
+SCALAPB_COMMON_PROTOS_VERSION = "2.9.6-0"
+SCALAPB_VERSION = "0.11.14"
+SCALAPB_PROTOC_VERSION = "0.9.5"
+CIRCE_CORE_VERSION = "0.14.5"
+CIRCE_OPTICS_VERSION = "0.15.0"
+CIRCE_YAML_VERSION = "0.15.0-RC1"
+RXJAVA_VERSION = "2.2.21"
+SPRAY_JSON_VERSION = "1.3.6"
+JAVAX_ANNOTATION_VERSION = "1.3.2"
+LOGBACK_VERSION = "1.5.3"
+SLF4J_VERSION = "2.0.17"
+MONOCLE_VERSION = "3.2.0"
+PEKKO_VERSION = "1.2.1"
+JUNIT_JUPITER_VERSION = "5.9.2"
+JUNIT_PLATFORM_VERSION = "1.9.2"
+SCALACHECK_VERSION = "1.15.4"
+SCALATEST_VERSION = "3.2.19"
+SCALATESTPLUS_VERSION = "3.2.11.0"
+SCALAZ_VERSION = "7.2.33"
+CATS_VERSION = "2.9.0"
+PAIGES_VERSION = "0.4.2"
+DOOBIE_VERSION = "0.13.4"
+KIND_PROJECTOR_VERSION = "0.13.3"
+WARTREMOVER_VERSION = "3.2.5"
+JLINE_VERSION = "3.27.1"
+
+# --- Maven / JVM dependencies ---
+
+maven_ext = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
+maven_ext.install(
+    artifacts = [
+        # com.daml / canton
+        "com.daml:base-errors_2.13:" + CANTON_VERSION,
+        "com.daml:bindings-java:" + CANTON_VERSION,
+        "com.daml:community-admin-api_2.13:" + CANTON_VERSION,
+        "com.daml:community-base_2.13:" + CANTON_VERSION,
+        "com.daml:contextualized-logging_2.13:" + CANTON_VERSION,
+        "com.daml:crypto_2.13:" + CANTON_VERSION,
+        "com.daml:daml-grpc-utils_2.13:" + CANTON_VERSION,
+        "com.daml:daml-jwt_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-api-type-signature_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-archive_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-archive-encoder_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-data_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-encoder_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-engine_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-ide-ledger_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-interpreter_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-language_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-parser_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-stable-packages_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-transaction_2.13:" + CANTON_VERSION,
+        "com.daml:daml-lf-validation_2.13:" + CANTON_VERSION,
+        "com.daml:daml-resources_2.13:" + CANTON_VERSION,
+        "com.daml:daml-tls_2.13:" + CANTON_VERSION,
+        "com.daml:ledger-api-core_2.13:" + CANTON_VERSION,
+        "com.daml:ledger-api-proto:" + CANTON_VERSION,
+        "com.daml:ledger-api-scala_2.13:" + CANTON_VERSION,
+        "com.daml:ledger-api-value_2.13:" + CANTON_VERSION,
+        "com.daml:ledger-resources_2.13:" + CANTON_VERSION,
+        "com.daml:logging-entries_2.13:" + CANTON_VERSION,
+        "com.daml:magnolify-addon_2.13:" + CANTON_VERSION,
+        "com.daml:nonempty_2.13:" + CANTON_VERSION,
+        "com.daml:observability-metrics_2.13:" + CANTON_VERSION,
+        "com.daml:ports_2.13:" + CANTON_VERSION,
+        "com.daml:rs-grpc-bridge_2.13:" + CANTON_VERSION,
+        "com.daml:rs-grpc-pekko_2.13:" + CANTON_VERSION,
+        "com.daml:scala-utils_2.13:" + CANTON_VERSION,
+        "com.daml:timer-utils_2.13:" + CANTON_VERSION,
+        "com.daml:util-observability_2.13:" + CANTON_VERSION,
+        "com.digitalasset.canton:testing-utils_2.13:" + CANTON_VERSION,
+
+        # auth
+        "com.auth0:java-jwt:" + AUTH0_JWT_VERSION,
+
+        # Scala extras
+        "com.chuusai:shapeless_2.13:" + SHAPELESS_VERSION,
+        "com.github.scopt:scopt_2.13:" + SCOPT_VERSION,
+        "com.typesafe.scala-logging:scala-logging_2.13:" + SCALA_LOGGING_VERSION,
+
+        # Google
+        "com.google.api.grpc:proto-google-common-protos:" + PROTO_GOOGLE_COMMON_PROTOS_VERSION,
+        "com.google.code.findbugs:jsr305:" + JSR305_VERSION,
+        "com.google.code.gson:gson:" + GSON_VERSION,
+        "com.google.guava:guava:" + GUAVA_VERSION,
+        "com.google.protobuf:protobuf-java:" + PROTOBUF_JAVA_VERSION,
+
+        # gRPC Java
+        "io.grpc:grpc-api:" + GRPC_JAVA_MAVEN_VERSION,
+        "io.grpc:grpc-core:" + GRPC_JAVA_MAVEN_VERSION,
+        "io.grpc:grpc-netty-shaded:" + GRPC_JAVA_MAVEN_VERSION,
+        "io.grpc:grpc-protobuf:" + GRPC_JAVA_MAVEN_VERSION,
+        "io.grpc:grpc-stub:" + GRPC_JAVA_MAVEN_VERSION,
+
+        # build tools
+        "com.oracle.database.jdbc:ojdbc8:" + OJDBC_VERSION,
+        "com.sparkjava:spark-core:" + SPARK_CORE_VERSION,
+        "com.squareup:javapoet:" + JAVAPOET_VERSION,
+
+        # ScalaPB
+        "com.thesamet.scalapb.common-protos:proto-google-common-protos-scalapb_0.11_2.13:" + SCALAPB_COMMON_PROTOS_VERSION,
+        "com.thesamet.scalapb:compilerplugin_2.13:" + SCALAPB_VERSION,
+        "com.thesamet.scalapb:lenses_2.13:" + SCALAPB_VERSION,
+        "com.thesamet.scalapb:protoc-bridge_2.13:" + SCALAPB_PROTOC_VERSION,
+        "com.thesamet.scalapb:protoc-gen_2.13:" + SCALAPB_PROTOC_VERSION,
+        "com.thesamet.scalapb:scalapb-runtime_2.13:" + SCALAPB_VERSION,
+        "com.thesamet.scalapb:scalapb-runtime-grpc_2.13:" + SCALAPB_VERSION,
+
+        # Circe
+        "io.circe:circe-core_2.13:" + CIRCE_CORE_VERSION,
+        "io.circe:circe-optics_2.13:" + CIRCE_OPTICS_VERSION,
+        "io.circe:circe-yaml_2.13:" + CIRCE_YAML_VERSION,
+        "io.circe:circe-yaml-common_2.13:" + CIRCE_YAML_VERSION,
+
+        # RxJava
+        "io.reactivex.rxjava2:rxjava:" + RXJAVA_VERSION,
+
+        # Spray
+        "io.spray:spray-json_2.13:" + SPRAY_JSON_VERSION,
+
+        # javax
+        "javax.annotation:javax.annotation-api:" + JAVAX_ANNOTATION_VERSION,
+
+        # Logging
+        "ch.qos.logback:logback-classic:" + LOGBACK_VERSION,
+        "ch.qos.logback:logback-core:" + LOGBACK_VERSION,
+        "org.slf4j:slf4j-api:" + SLF4J_VERSION,
+
+        # Optics
+        "dev.optics:monocle-core_2.13:" + MONOCLE_VERSION,
+
+        # Pekko
+        "org.apache.pekko:pekko-actor_2.13:" + PEKKO_VERSION,
+        "org.apache.pekko:pekko-slf4j_2.13:" + PEKKO_VERSION,
+        "org.apache.pekko:pekko-stream_2.13:" + PEKKO_VERSION,
+
+        # JUnit
+        "org.junit.jupiter:junit-jupiter-api:" + JUNIT_JUPITER_VERSION,
+        "org.junit.jupiter:junit-jupiter-engine:" + JUNIT_JUPITER_VERSION,
+        "org.junit.platform:junit-platform-commons:" + JUNIT_PLATFORM_VERSION,
+        "org.junit.platform:junit-platform-runner:" + JUNIT_PLATFORM_VERSION,
+
+        # Scala test
+        "org.scalacheck:scalacheck_2.13:" + SCALACHECK_VERSION,
+        "org.scalactic:scalactic_2.13:" + SCALATEST_VERSION,
+        "org.scalatest:scalatest_2.13:" + SCALATEST_VERSION,
+        "org.scalatest:scalatest-compatible:" + SCALATEST_VERSION,
+        "org.scalatest:scalatest-core_2.13:" + SCALATEST_VERSION,
+        "org.scalatest:scalatest-flatspec_2.13:" + SCALATEST_VERSION,
+        "org.scalatest:scalatest-matchers-core_2.13:" + SCALATEST_VERSION,
+        "org.scalatest:scalatest-shouldmatchers_2.13:" + SCALATEST_VERSION,
+        "org.scalatest:scalatest-wordspec_2.13:" + SCALATEST_VERSION,
+        "org.scalatestplus:scalacheck-1-15_2.13:" + SCALATESTPLUS_VERSION,
+
+        # Scalaz
+        "org.scalaz:scalaz-core_2.13:" + SCALAZ_VERSION,
+        "org.scalaz:scalaz-scalacheck-binding_2.13:" + SCALAZ_VERSION + "-scalacheck-1.15",
+
+        # Typelevel
+        "org.typelevel:cats-core_2.13:" + CATS_VERSION,
+        "org.typelevel:cats-kernel_2.13:" + CATS_VERSION,
+        "org.typelevel:paiges-core_2.13:" + PAIGES_VERSION,
+
+        # Database
+        "org.tpolecat:doobie-postgres_2.13:" + DOOBIE_VERSION,
+
+        # Code quality
+        "org.typelevel:kind-projector_2.13.16:" + KIND_PROJECTOR_VERSION,
+        "org.wartremover:wartremover_2.13.16:" + WARTREMOVER_VERSION,
+        "org.jline:jline:" + JLINE_VERSION,
+    ],
+    fetch_sources = True,
+    known_contributing_modules = [
+        "bazel_jar_jar",
+        "bazel_worker_java",
+        "protobuf",
+    ],
+    repositories = [
+        "https://repo1.maven.org/maven2",
+        "https://europe-maven.pkg.dev/da-images/public-maven-unstable",
+    ],
+)
+maven_ext.override(
+    coordinates = "org.scala-lang:scala-compiler",
+    target = "@io_bazel_rules_scala_scala_compiler//:io_bazel_rules_scala_scala_compiler",
+)
+maven_ext.override(
+    coordinates = "org.scala-lang:scala-library",
+    target = "@io_bazel_rules_scala_scala_library//:io_bazel_rules_scala_scala_library",
+)
+maven_ext.override(
+    coordinates = "org.scala-lang:scala-reflect",
+    target = "@io_bazel_rules_scala_scala_reflect//:io_bazel_rules_scala_scala_reflect",
+)
+maven_ext.override(
+    coordinates = "org.scala-lang.modules:scala-parser-combinators",
+    target = "@io_bazel_rules_scala_scala_parser_combinators//:io_bazel_rules_scala_scala_parser_combinators",
+)
+use_repo(maven_ext, "maven")
+
+# --- Project-specific extensions ---
+
+# Workspace configuration: bundles build_environment (SDK version from env),
+# os_info (platform detection), scala_version (Scala version from env),
+# and daml_versions_data (LF version data from JSON).
+# TODO: Split into per-concern extensions.
+workspace_config_ext = use_extension("//bazel/extensions:daml_workspace_config_extension.bzl", "daml_workspace_config")
+use_repo(workspace_config_ext, "build_environment", "daml_versions_data", "os_info", "scala_version")
+
+dpm_ext = use_extension("//bazel/extensions:dpm_extension.bzl", "dpm_extension")
+use_repo(dpm_ext, "dpm_binary")
+
+d3plus_ext = use_extension("//bazel/extensions:d3plus_extension.bzl", "d3plus_extension")
+use_repo(d3plus_ext, "static_asset_d3plus")
+
+googleapis_ext = use_extension("//bazel/extensions:go_googleapis_extension.bzl", "googleapis_extension")
+use_repo(googleapis_ext, "go_googleapis")
+
+import_googleapis_ext = use_extension("//bazel/extensions:go_googleapis_import_extension.bzl", "import_googleapis_extension")
+use_repo(import_googleapis_ext, "com_google_googleapis_imports")
+
+proto3_suite_ext = use_extension("//bazel/extensions:proto3_suite_extension.bzl", "proto3_suite_extension")
+use_repo(proto3_suite_ext, "proto3-suite")
+
+# --- Deprecated (pending removal) ---
+# io_grpc_grpc_java: legacy gRPC Java codegen; to be replaced by rules_proto + protobuf bazel_dep.
+# protoc_bindist: legacy protoc binary distribution; to be replaced by the protobuf bazel_dep toolchain.
+# TODO: Remove once all targets have migrated to the new protobuf/gRPC setup.
+
+io_grpc_grpc_java_ext = use_extension("//bazel/extensions:io_grpc_grpc_java_extension.bzl", "io_grpc_grpc_java_extension")
+use_repo(io_grpc_grpc_java_ext, "io_grpc_grpc_java")
+
+protoc_ext = use_extension("//bazel/extensions:protoc_extension.bzl", "protoc_extension")
+use_repo(protoc_ext, "protoc_bindist")
+
+# --- Native libraries ---
+
+ncurses_ext = use_extension("//bazel/extensions:ncurses_extension.bzl", "ncurses")
+use_repo(ncurses_ext, "ncurses")
+
+m4_ext = use_extension("//bazel/extensions:m4_extension.bzl", "m4")
+use_repo(m4_ext, "m4")
+
+autoconf_ext = use_extension("//bazel/extensions:autoconf_extension.bzl", "autoconf")
+use_repo(autoconf_ext, "autoconf")
+automake_ext = use_extension("//bazel/extensions:automake_extension.bzl", "automake")
+use_repo(automake_ext, "automake")
\ No newline at end of file
diff --git a/sdk/WORKSPACE b/sdk/WORKSPACE
index edd74a7f6f27..3e0fc3b5d381 100644
--- a/sdk/WORKSPACE
+++ b/sdk/WORKSPACE
@@ -784,10 +784,6 @@ load("@build_bazel_rules_apple//apple:repositories.bzl", "apple_rules_dependenci
 
 apple_rules_dependencies()
 
-load("@com_github_bazelbuild_buildtools//buildifier:deps.bzl", "buildifier_dependencies")
-
-buildifier_dependencies()
-
 nixpkgs_package(
     name = "postgresql_nix",
     attribute_path = "postgresql_12",
diff --git a/sdk/bazel-haskell-deps.bzl b/sdk/bazel-haskell-deps.bzl
index e79aa3440201..1413080bdd24 100644
--- a/sdk/bazel-haskell-deps.bzl
+++ b/sdk/bazel-haskell-deps.bzl
@@ -462,7 +462,7 @@ exports_files(["stack.exe"], visibility = ["//visibility:public"])
             },
         ),
         haddock = False,
-        local_snapshot = "//:stack-snapshot.yaml",
+        local_snapshot = "//:stackage_snapshot.yaml",
         stack_snapshot_json =
             "//:stackage_snapshot_windows.json" if is_windows else "//:stackage_snapshot.json",
         packages = [
diff --git a/sdk/bazel/extensions/BUILD b/sdk/bazel/extensions/BUILD
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/bazel/extensions/autoconf_extension.bzl b/sdk/bazel/extensions/autoconf_extension.bzl
new file mode 100644
index 000000000000..7da4841ffc2b
--- /dev/null
+++ b/sdk/bazel/extensions/autoconf_extension.bzl
@@ -0,0 +1,17 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:gnu_tools.version.bzl",
+    "AUTOCONF_SHA256",
+    "AUTOCONF_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "autoconf",
+        urls = ["https://ftp.gnu.org/gnu/autoconf/autoconf-{}.tar.gz".format(AUTOCONF_VERSION)],
+        strip_prefix = "autoconf-{}".format(AUTOCONF_VERSION),
+        sha256 = AUTOCONF_SHA256,
+        build_file = ":files/autoconf.BUILD.bzl",
+    )
+
+autoconf = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/automake_extension.bzl b/sdk/bazel/extensions/automake_extension.bzl
new file mode 100644
index 000000000000..f48cb9be5ebf
--- /dev/null
+++ b/sdk/bazel/extensions/automake_extension.bzl
@@ -0,0 +1,17 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:gnu_tools.version.bzl",
+    "AUTOMAKE_SHA256",
+    "AUTOMAKE_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "automake",
+        urls = ["https://ftp.gnu.org/gnu/automake/automake-{}.tar.gz".format(AUTOMAKE_VERSION)],
+        strip_prefix = "automake-{}".format(AUTOMAKE_VERSION),
+        sha256 = AUTOMAKE_SHA256,
+        build_file = ":files/automake.BUILD.bzl",
+    )
+
+automake = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/cabal_extension.bzl b/sdk/bazel/extensions/cabal_extension.bzl
new file mode 100644
index 000000000000..448613d8d811
--- /dev/null
+++ b/sdk/bazel/extensions/cabal_extension.bzl
@@ -0,0 +1,37 @@
+load("//bazel/versions:cabal.version.bzl", "CABAL_PLATFORMS")
+
+def _cabal_install_impl(repository_ctx):
+    os_name = repository_ctx.os.name
+    os_arch = repository_ctx.os.arch
+
+    if "linux" in os_name:
+        arch = "aarch64" if os_arch == "aarch64" else "x86_64"
+        platform_key = "linux-" + arch
+    elif "mac" in os_name:
+        arch = "aarch64" if os_arch == "aarch64" else "x86_64"
+        platform_key = "darwin-" + arch
+    elif "windows" in os_name:
+        platform_key = "windows-x86_64"
+    else:
+        fail("Unsupported OS for cabal-install: " + os_name)
+
+    platform = CABAL_PLATFORMS[platform_key]
+    repository_ctx.download_and_extract(
+        url = platform["url"],
+        sha256 = platform["sha256"],
+    )
+
+    cabal_bin = "cabal.exe" if "windows" in os_name else "cabal"
+    repository_ctx.file(
+        "BUILD.bazel",
+        'exports_files(["{}"], visibility = ["//visibility:public"])\n'.format(cabal_bin),
+    )
+
+_cabal_install = repository_rule(
+    implementation = _cabal_install_impl,
+)
+
+def _impl(module_ctx):
+    _cabal_install(name = "cabal")
+
+cabal = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/d3plus_extension.bzl b/sdk/bazel/extensions/d3plus_extension.bzl
new file mode 100644
index 000000000000..57092175f8f6
--- /dev/null
+++ b/sdk/bazel/extensions/d3plus_extension.bzl
@@ -0,0 +1,21 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:d3plus.version.bzl",
+    "D3PLUS_SHA256",
+    "D3PLUS_VERSION",
+)
+
+def _get_d3plus():
+    http_archive(
+        name = "static_asset_d3plus",
+        build_file_content = 'exports_files(["js/d3.min.js", "js/d3plus.min.js"])',
+        sha256 = D3PLUS_SHA256,
+        strip_prefix = "d3plus.v{}".format(D3PLUS_VERSION),
+        type = "zip",
+        urls = ["https://github.com/alexandersimoes/d3plus/releases/download/v{}/d3plus.zip".format(D3PLUS_VERSION)],
+    )
+
+def _impl(module_ctx):
+    _get_d3plus()
+
+d3plus_extension = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/da_ghc_extension.bzl b/sdk/bazel/extensions/da_ghc_extension.bzl
new file mode 100644
index 000000000000..ed05ea620c88
--- /dev/null
+++ b/sdk/bazel/extensions/da_ghc_extension.bzl
@@ -0,0 +1,38 @@
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:da_ghc.version.bzl",
+    "GHC_LIB_REPO_URL",
+    "GHC_LIB_REV",
+    "GHC_LIB_SHA256",
+    "GHC_REPO_URL",
+    "GHC_REV",
+)
+
+def _get_ghc_lib_gen():
+    http_archive(
+        name = "ghc-lib-gen",
+        url = "{}/archive/{}.tar.gz".format(GHC_LIB_REPO_URL, GHC_LIB_REV),
+        sha256 = GHC_LIB_SHA256,
+        strip_prefix = "ghc-lib-{}".format(GHC_LIB_REV),
+        build_file = ":files/ghc_lib_gen.BUILD.bzl",
+        patches = ["//bazel/patches:haskell/ghc_lib_no_stack.patch"],
+        patch_args = ["-p1"],
+    )
+
+def _get_da_ghc():
+    git_repository(
+        name = "da-ghc",
+        remote = GHC_REPO_URL,
+        commit = GHC_REV,
+        recursive_init_submodules = True,
+        build_file = ":files/da_ghc.BUILD.bzl",
+        shallow_since = "1771323697 +0100",
+        patch_args = ["-p1"],
+    )
+
+def _impl(module_ctx):
+    _get_ghc_lib_gen()
+    _get_da_ghc()
+
+da_ghc = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/dpm_extension.bzl b/sdk/bazel/extensions/dpm_extension.bzl
new file mode 100644
index 000000000000..b78d5b5a42fb
--- /dev/null
+++ b/sdk/bazel/extensions/dpm_extension.bzl
@@ -0,0 +1,18 @@
+load("//bazel_tools:dpm.bzl", "dpm_binary")
+load(
+    "//bazel/versions:dpm.version.bzl",
+    "DPM_SHA256",
+    "DPM_VERSION",
+)
+
+def _get_dpm(module_ctx):
+    dpm_binary(
+        name = "dpm_binary",
+        sha256 = DPM_SHA256,
+        version = DPM_VERSION,
+    )
+
+def _impl(module_ctx):
+    _get_dpm(module_ctx)
+
+dpm_extension = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/files/autoconf.BUILD.bzl b/sdk/bazel/extensions/files/autoconf.BUILD.bzl
new file mode 100644
index 000000000000..a591b7974470
--- /dev/null
+++ b/sdk/bazel/extensions/files/autoconf.BUILD.bzl
@@ -0,0 +1,7 @@
+exports_files(["README"])
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)
diff --git a/sdk/bazel/extensions/files/automake.BUILD.bzl b/sdk/bazel/extensions/files/automake.BUILD.bzl
new file mode 100644
index 000000000000..3e5ce2a47308
--- /dev/null
+++ b/sdk/bazel/extensions/files/automake.BUILD.bzl
@@ -0,0 +1,22 @@
+load(
+    "@//bazel/rules:install_gnu_tool.bzl",
+    "install_gnu_tool",
+)
+
+exports_files(["README"])
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)
+
+install_gnu_tool(
+    name = "automake",
+    srcs = ":srcs",
+    configure = "configure",
+    perl = "@rules_perl//:current_toolchain",
+    extra_tools = ["@m4//:m4"],
+    pre_build_srcs = ["@autoconf//:srcs"],
+    visibility = ["//visibility:public"],
+)
diff --git a/sdk/bazel/extensions/files/da_ghc.BUILD.bzl b/sdk/bazel/extensions/files/da_ghc.BUILD.bzl
new file mode 100644
index 000000000000..bd3d54dc95bc
--- /dev/null
+++ b/sdk/bazel/extensions/files/da_ghc.BUILD.bzl
@@ -0,0 +1,93 @@
+load(
+    "@//bazel/versions:da_ghc.version.bzl",
+    "GHC_CPP_OPTIONS",
+    "GHC_FLAVOR",
+    "GHC_LIB_VERSION",
+)
+load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_binary")
+load("@//bazel/rules:ghc_lib_sdist.bzl", "ghc_lib_sdist")
+
+filegroup(
+    name = "hadrian-srcs",
+    srcs = glob(["hadrian/**"]),
+    visibility = ["//visibility:public"],
+)
+
+haskell_cabal_binary(
+    name = "hadrian",
+    flags = ["with_bazel"],
+    srcs = [":hadrian-srcs"],
+    deps = [
+        "@stackage//:base",
+        "@stackage//:Cabal",
+        "@stackage//:containers",
+        "@stackage//:directory",
+        "@stackage//:extra",
+        "@stackage//:mtl",
+        "@stackage//:parsec",
+        "@stackage//:QuickCheck",
+        "@stackage//:shake",
+        "@stackage//:transformers",
+        "@stackage//:unordered-containers",
+    ],
+    tools = [
+        "@stackage-exe//alex",
+        "@stackage-exe//happy",
+    ],
+    cabalopts = [
+        "--ghc-option=-Wno-dodgy-imports",
+        "--ghc-option=-Wno-unused-imports",
+    ],
+)
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)
+
+ghc_lib_sdist(
+    name = "ghc-lib",
+    ghc_srcs = ":srcs",
+    readme = ":README.md",
+    ghc_lib_gen = "@ghc-lib-gen//:ghc-lib-gen",
+    hadrian = ":hadrian",
+    autotools = "@automake//:automake",
+    m4 = "@m4//:m4",
+    perl = "@rules_perl//:current_toolchain",
+    cabal = "@cabal//:cabal",
+    component = "",
+    version = GHC_LIB_VERSION,
+    ghc_flavor = GHC_FLAVOR,
+    extra_tools = [
+        "@stackage-exe//happy",
+        "@stackage-exe//alex",
+    ],
+    cpp_options = GHC_CPP_OPTIONS,
+    cabal_out = "ghc-lib.cabal",
+    tarball_out = "ghc-lib-{}.tar.gz".format(GHC_LIB_VERSION),
+    visibility = ["//visibility:public"],
+)
+
+ghc_lib_sdist(
+    name = "ghc-lib-parser",
+    ghc_srcs = ":srcs",
+    readme = ":README.md",
+    ghc_lib_gen = "@ghc-lib-gen//:ghc-lib-gen",
+    hadrian = ":hadrian",
+    autotools = "@automake//:automake",
+    m4 = "@m4//:m4",
+    perl = "@rules_perl//:current_toolchain",
+    cabal = "@cabal//:cabal",
+    component = "-parser",
+    version = GHC_LIB_VERSION,
+    ghc_flavor = GHC_FLAVOR,
+    extra_tools = [
+        "@stackage-exe//happy",
+        "@stackage-exe//alex",
+    ],
+    cpp_options = GHC_CPP_OPTIONS,
+    cabal_out = "ghc-lib-parser.cabal",
+    tarball_out = "ghc-lib-parser-{}.tar.gz".format(GHC_LIB_VERSION),
+    visibility = ["//visibility:public"],
+)
diff --git a/sdk/bazel/extensions/files/ghc_lib_gen.BUILD.bzl b/sdk/bazel/extensions/files/ghc_lib_gen.BUILD.bzl
new file mode 100644
index 000000000000..cefe5957c464
--- /dev/null
+++ b/sdk/bazel/extensions/files/ghc_lib_gen.BUILD.bzl
@@ -0,0 +1,39 @@
+load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_binary", "haskell_cabal_library")
+
+haskell_cabal_library(
+    name = "ghc-lib-gen-lib",
+    package_name = "ghc-lib-gen",
+    version = "0.1.0.0",
+    haddock = False,
+    srcs = glob(["**"]),
+    deps = [
+        "@stackage//:base",
+        "@stackage//:process",
+        "@stackage//:filepath",
+        "@stackage//:containers",
+        "@stackage//:directory",
+        "@stackage//:optparse-applicative",
+        "@stackage//:bytestring",
+        "@stackage//:yaml",
+        "@stackage//:aeson",
+        "@stackage//:text",
+        "@stackage//:unordered-containers",
+        "@stackage//:extra",
+    ],
+)
+
+haskell_cabal_binary(
+    name = "ghc-lib-gen",
+    srcs = glob(["**"]),
+    deps = [
+        ":ghc-lib-gen-lib",
+        "@stackage//:base",
+        "@stackage//:containers",
+        "@stackage//:directory",
+        "@stackage//:extra",
+        "@stackage//:filepath",
+        "@stackage//:optparse-applicative",
+        "@stackage//:process",
+    ],
+    visibility = ["//visibility:public"],
+)
diff --git a/sdk/bazel/extensions/files/ghcide.BUILD.bzl b/sdk/bazel/extensions/files/ghcide.BUILD.bzl
new file mode 100644
index 000000000000..293c9df098f1
--- /dev/null
+++ b/sdk/bazel/extensions/files/ghcide.BUILD.bzl
@@ -0,0 +1,46 @@
+load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_library")
+load("@rules_haskell//haskell:defs.bzl", "haskell_library")
+load("@stackage//:packages.bzl", "packages")
+
+haskell_cabal_library(
+    name = "ghcide",
+    version = packages["ghcide"].version,
+    srcs = glob(["**"]),
+    haddock = False,
+    flags = packages["ghcide"].flags,
+    deps = packages["ghcide"].deps,
+    visibility = ["//visibility:public"],
+)
+haskell_library(
+    name = "testing",
+    srcs = glob(["test/src/**/*.hs"]),
+    src_strip_prefix = "test/src",
+    deps = [
+        "@stackage//:aeson",
+        "@stackage//:base",
+        "@stackage//:extra",
+        "@stackage//:containers",
+        "@stackage//:lsp-types",
+        "@stackage//:lens",
+        "@stackage//:lsp-test",
+        "@stackage//:parser-combinators",
+        "@stackage//:tasty-hunit",
+        "@stackage//:text",
+    ],
+    ghcopts = [
+        "-XBangPatterns",
+        "-XDeriveFunctor",
+        "-XDeriveGeneric",
+        "-XGeneralizedNewtypeDeriving",
+        "-XLambdaCase",
+        "-XNamedFieldPuns",
+        "-XOverloadedStrings",
+        "-XRecordWildCards",
+        "-XScopedTypeVariables",
+        "-XStandaloneDeriving",
+        "-XTupleSections",
+        "-XTypeApplications",
+        "-XViewPatterns",
+    ],
+    visibility = ["//visibility:public"],
+)
diff --git a/sdk/bazel/extensions/files/lsp_types.BUILD.bzl b/sdk/bazel/extensions/files/lsp_types.BUILD.bzl
new file mode 100644
index 000000000000..d7d8d89b0f04
--- /dev/null
+++ b/sdk/bazel/extensions/files/lsp_types.BUILD.bzl
@@ -0,0 +1,11 @@
+load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_library")
+load("@stackage//:packages.bzl", "packages")
+
+haskell_cabal_library(
+    name = "lsp-types",
+    version = packages["lsp-types"].version,
+    srcs = glob(["**"]),
+    deps = packages["lsp-types"].deps,
+    haddock = False,
+    visibility = ["//visibility:public"],
+)
diff --git a/sdk/bazel/extensions/files/m4.BUILD.bzl b/sdk/bazel/extensions/files/m4.BUILD.bzl
new file mode 100644
index 000000000000..7444ecbc163c
--- /dev/null
+++ b/sdk/bazel/extensions/files/m4.BUILD.bzl
@@ -0,0 +1,20 @@
+genrule(
+    name = "m4_binary",
+    srcs = glob(["**"]),
+    outs = ["m4"],
+    toolchains = ["@rules_cc//cc:current_cc_toolchain"],
+    cmd = """
+        set -euo pipefail
+
+        OUT=$$PWD/$@
+        SRC=$$(dirname $(location configure))
+
+        cd $$SRC
+
+        CC=$(CC) ./configure
+        make -j
+
+        cp src/m4 $$OUT
+    """,
+    visibility = ["//visibility:public"],
+)
\ No newline at end of file
diff --git a/sdk/bazel/extensions/files/ncurses.BUILD.bzl b/sdk/bazel/extensions/files/ncurses.BUILD.bzl
new file mode 100644
index 000000000000..d472577d6904
--- /dev/null
+++ b/sdk/bazel/extensions/files/ncurses.BUILD.bzl
@@ -0,0 +1,58 @@
+genrule(
+    name = "ncurses_build",
+    srcs = glob(["**"]),
+    outs = [
+        "lib/libtinfow.so",
+        "lib/libncursesw.so",
+        "lib/libformw.so",
+        "lib/libmenuw.so",
+        "lib/libpanelw.so",
+        "lib/libtinfo.so",
+        "lib/libncurses.so",
+        "lib/libform.so",
+        "lib/libmenu.so",
+        "lib/libpanel.so",
+    ],
+    cmd = """
+        SRC=$$(dirname $(location configure))
+        PREFIX=$$(realpath $(@D))
+        cd $$SRC && CC="$(CC)" AR="$(AR)" \
+        ./configure \
+            --prefix=$$PREFIX \
+            --with-shared \
+            --with-termlib \
+            --enable-widec \
+            --without-debug \
+            --without-ada \
+            --without-manpages \
+            --without-tests \
+        && make -j$$(nproc) CC="$(CC)" AR="$(AR)" \
+        && make install \
+        && cd $$PREFIX/lib \
+        && for f in *.so; do \
+            if [ -L "$$f" ]; then \
+                target=$$(readlink -f "$$f"); \
+                rm "$$f"; \
+                cp "$$target" "$$f"; \
+            fi; \
+        done \
+        && for f in *.so.*; do \
+            if [ -L "$$f" ]; then \
+                target=$$(readlink -f "$$f"); \
+                rm "$$f"; \
+                cp "$$target" "$$f"; \
+            fi; \
+        done \
+        && for lib in ncurses form menu panel; do \
+            cp lib$${lib}w.so lib$${lib}.so; \
+        done \
+        && cp libtinfow.so libtinfo.so
+    """,
+    toolchains = ["@rules_cc//cc:current_cc_toolchain"],
+)
+
+filegroup(
+    name = "libs",
+    srcs = [":ncurses_build"],
+    visibility = ["//visibility:public"],
+)
\ No newline at end of file
diff --git a/sdk/bazel/extensions/files/proto3_suite.BUILD.bzl b/sdk/bazel/extensions/files/proto3_suite.BUILD.bzl
new file mode 100644
index 000000000000..691da985a222
--- /dev/null
+++ b/sdk/bazel/extensions/files/proto3_suite.BUILD.bzl
@@ -0,0 +1,27 @@
+load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_library")
+
+# XXX: haskell_cabal_binary inexplicably fails with
+#   realgcc.exe: error: CreateProcess: No such file or directory
+# So we use haskell_binary instead.
+load("@rules_haskell//haskell:defs.bzl", "haskell_binary")
+load("@stackage//:packages.bzl", "packages")
+
+deps = [p for p in packages["proto3-suite"].deps if p != "swagger2"]
+haskell_cabal_library(
+    name = "proto3-suite",
+    version = packages["proto3-suite"].version,
+    srcs = glob(["src/**", "test-files/*.bin", "tests/*", "proto3-suite.cabal"]),
+    haddock = False,
+    deps = deps,
+    verbose = False,
+    visibility = ["//visibility:public"],
+    flags = ["-swagger"],
+)
+
+haskell_binary(
+    name = "compile-proto-file",
+    srcs = ["tools/compile-proto-file/Main.hs"],
+    ghcopts = ["-w", "-optF=-w"],
+    deps = [":proto3-suite"] + deps,
+    visibility = ["//visibility:public"],
+)
diff --git a/sdk/bazel/extensions/files/zip.BUILD.bzl b/sdk/bazel/extensions/files/zip.BUILD.bzl
new file mode 100644
index 000000000000..32161d1c0f6d
--- /dev/null
+++ b/sdk/bazel/extensions/files/zip.BUILD.bzl
@@ -0,0 +1,13 @@
+load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_library")
+load("@stackage//:packages.bzl", "packages")
+
+haskell_cabal_library(
+    name = "zip",
+    version = packages["zip"].version,
+    srcs = glob(["**"]),
+    haddock = False,
+    deps = packages["zip"].deps,
+    verbose = False,
+    visibility = ["//visibility:public"],
+    flags = packages["zip"].flags,
+)
diff --git a/sdk/bazel/extensions/ghcide_extension.bzl b/sdk/bazel/extensions/ghcide_extension.bzl
new file mode 100644
index 000000000000..d919d591fe54
--- /dev/null
+++ b/sdk/bazel/extensions/ghcide_extension.bzl
@@ -0,0 +1,22 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:ghcide.version.bzl",
+    "GHCIDE_REPO_URL",
+    "GHCIDE_REV",
+    "GHCIDE_SHA256",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "ghcide_lib",
+        build_file = ":files/ghcide.BUILD.bzl",
+        patch_args = ["-p1"],
+        patches = [
+            "//bazel/patches:haskell/ghcide_binary_q.patch",
+        ],
+        sha256 = GHCIDE_SHA256,
+        strip_prefix = "daml-ghcide-%s" % GHCIDE_REV,
+        url = "{}/archive/{}.tar.gz".format(GHCIDE_REPO_URL, GHCIDE_REV),
+    )
+
+ghcide_lib = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/go_googleapis_extension.bzl b/sdk/bazel/extensions/go_googleapis_extension.bzl
new file mode 100644
index 000000000000..e251632ca0df
--- /dev/null
+++ b/sdk/bazel/extensions/go_googleapis_extension.bzl
@@ -0,0 +1,26 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:googleapis.version.bzl",
+    "GOOGLEAPIS_SHA256",
+    "GOOGLEAPIS_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "go_googleapis",
+        # We must use the same version as rules_go
+        # master, as of 2022-12-05
+        urls = [
+            "https://mirror.bazel.build/github.com/googleapis/googleapis/archive/{}.zip".format(GOOGLEAPIS_VERSION),
+            "https://github.com/googleapis/googleapis/archive/{}.zip".format(GOOGLEAPIS_VERSION),
+        ],
+        sha256 = GOOGLEAPIS_SHA256,
+        strip_prefix = "googleapis-{}".format(GOOGLEAPIS_VERSION),
+        patches = [
+            # The Haskell gRPC bindings require access to the status.proto source file.
+            "//bazel/patches:go_googleapis/status-proto.patch",
+        ],
+        patch_args = ["-E", "-p1"],
+    )
+
+googleapis_extension = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/go_googleapis_import_extension.bzl b/sdk/bazel/extensions/go_googleapis_import_extension.bzl
new file mode 100644
index 000000000000..e6a22ab7f722
--- /dev/null
+++ b/sdk/bazel/extensions/go_googleapis_import_extension.bzl
@@ -0,0 +1,10 @@
+load("@go_googleapis//:repository_rules.bzl", "switched_rules_by_language")
+
+def _impl(module_ctx):
+    switched_rules_by_language(
+        name = "com_google_googleapis_imports",
+        grpc = True,
+        java = True,
+    )
+
+import_googleapis_extension = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/io_grpc_grpc_java_extension.bzl b/sdk/bazel/extensions/io_grpc_grpc_java_extension.bzl
new file mode 100644
index 000000000000..eeb72f9f2c7a
--- /dev/null
+++ b/sdk/bazel/extensions/io_grpc_grpc_java_extension.bzl
@@ -0,0 +1,16 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:grpc_java.version.bzl",
+    "GRPC_JAVA_SHA256",
+    "GRPC_JAVA_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "io_grpc_grpc_java",
+        strip_prefix = "grpc-java-{}".format(GRPC_JAVA_VERSION),
+        urls = ["https://github.com/grpc/grpc-java/archive/v{}.tar.gz".format(GRPC_JAVA_VERSION)],
+        sha256 = GRPC_JAVA_SHA256,
+    )
+
+io_grpc_grpc_java_extension = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/lsp_types_extension.bzl b/sdk/bazel/extensions/lsp_types_extension.bzl
new file mode 100644
index 000000000000..e931cfec6aa2
--- /dev/null
+++ b/sdk/bazel/extensions/lsp_types_extension.bzl
@@ -0,0 +1,22 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:lsp_types.version.bzl",
+    "LSP_TYPES_SHA256",
+    "LSP_TYPES_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "lsp-types",
+        build_file = ":files/lsp_types.BUILD.bzl",
+        patch_args = ["-p1"],
+        patches = [
+            "//bazel/patches:haskell/lsp_types_normalisation.patch",
+            "//bazel/patches:haskell/lsp_types_expose_other_modules.patch",
+        ],
+        sha256 = LSP_TYPES_SHA256,
+        strip_prefix = "lsp-types-{}".format(LSP_TYPES_VERSION),
+        urls = ["http://hackage.haskell.org/package/lsp-types-{version}/lsp-types-{version}.tar.gz".format(version = LSP_TYPES_VERSION)],
+    )
+
+lsp_types = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/m4_extension.bzl b/sdk/bazel/extensions/m4_extension.bzl
new file mode 100644
index 000000000000..5b55fa96e196
--- /dev/null
+++ b/sdk/bazel/extensions/m4_extension.bzl
@@ -0,0 +1,17 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:gnu_tools.version.bzl",
+    "M4_SHA256",
+    "M4_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "m4",
+        urls = ["https://ftp.gnu.org/gnu/m4/m4-{}.tar.gz".format(M4_VERSION)],
+        strip_prefix = "m4-{}".format(M4_VERSION),
+        sha256 = M4_SHA256,
+        build_file = ":files/m4.BUILD.bzl",
+    )
+
+m4 = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/ncurses_extension.bzl b/sdk/bazel/extensions/ncurses_extension.bzl
new file mode 100644
index 000000000000..91e6390d2979
--- /dev/null
+++ b/sdk/bazel/extensions/ncurses_extension.bzl
@@ -0,0 +1,17 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:gnu_tools.version.bzl",
+    "NCURSES_SHA256",
+    "NCURSES_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "ncurses",
+        url = "https://ftp.gnu.org/gnu/ncurses/ncurses-{}.tar.gz".format(NCURSES_VERSION),
+        sha256 = NCURSES_SHA256,
+        strip_prefix = "ncurses-{}".format(NCURSES_VERSION),
+        build_file = ":files/ncurses.BUILD.bzl",
+    )
+
+ncurses = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/proto3_suite_extension.bzl b/sdk/bazel/extensions/proto3_suite_extension.bzl
new file mode 100644
index 000000000000..109f41c00555
--- /dev/null
+++ b/sdk/bazel/extensions/proto3_suite_extension.bzl
@@ -0,0 +1,22 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:proto3_suite.version.bzl",
+    "PROTO3SUITE_SHA256",
+    "PROTO3SUITE_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "proto3-suite",
+        build_file = ":files/proto3_suite.BUILD.bzl",
+        sha256 = PROTO3SUITE_SHA256,
+        strip_prefix = "proto3-suite-{}".format(PROTO3SUITE_VERSION),
+        urls = ["https://github.com/awakesecurity/proto3-suite/archive/refs/tags/v{}.tar.gz".format(PROTO3SUITE_VERSION)],
+        patches = [
+            "//bazel/patches:proto3_suite/deriving_defaults.patch",
+            "//bazel/patches:proto3_suite/support_reserved_enums.patch",
+        ],
+        patch_args = ["-p1"],
+    )
+
+proto3_suite_extension = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/protoc_extension.bzl b/sdk/bazel/extensions/protoc_extension.bzl
new file mode 100644
index 000000000000..735b6d5bf4c2
--- /dev/null
+++ b/sdk/bazel/extensions/protoc_extension.bzl
@@ -0,0 +1,67 @@
+load(
+    "//bazel/versions:protoc.version.bzl",
+    "PROTOC_SHA256S",
+    "PROTOC_VERSION",
+)
+
+_PROTOC_URL_TEMPLATE = "https://github.com/protocolbuffers/protobuf/releases/download/v{version}/protoc-{version}-{platform}.zip"
+
+def _detect_platform(rctx):
+    """Map host OS/arch to protoc release platform string.
+
+    Returns:
+        (platform_string, is_windows) tuple.
+    """
+    os = rctx.os.name.lower()
+    arch = rctx.os.arch
+
+    if "mac os x" in os:
+        if arch == "aarch64":
+            return "osx-aarch_64", False
+        return "osx-x86_64", False
+
+    if "windows" in os:
+        return "win64", True
+
+    if arch == "aarch64":
+        return "linux-aarch_64", False
+    return "linux-x86_64", False
+
+def _protoc_bindist_impl(rctx):
+    platform, is_windows = _detect_platform(rctx)
+    sha256 = rctx.attr.sha256s.get(platform, "")
+    url = _PROTOC_URL_TEMPLATE.format(
+        version = rctx.attr.version,
+        platform = platform,
+    )
+
+    rctx.download_and_extract(url = url, sha256 = sha256)
+
+    actual_binary = "bin/protoc.exe" if is_windows else "bin/protoc"
+    rctx.file("BUILD.bazel", """\
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["{binary}"])
+
+alias(
+    name = "protoc",
+    actual = "{binary}",
+)
+""".format(binary = actual_binary))
+
+_protoc_bindist = repository_rule(
+    implementation = _protoc_bindist_impl,
+    attrs = {
+        "version": attr.string(mandatory = True),
+        "sha256s": attr.string_dict(),
+    },
+)
+
+def _impl(module_ctx):
+    _protoc_bindist(
+        name = "protoc_bindist",
+        version = PROTOC_VERSION,
+        sha256s = PROTOC_SHA256S,
+    )
+
+protoc_extension = module_extension(implementation = _impl)
diff --git a/sdk/bazel/extensions/zip_extension.bzl b/sdk/bazel/extensions/zip_extension.bzl
new file mode 100644
index 000000000000..a6ebe0f4d786
--- /dev/null
+++ b/sdk/bazel/extensions/zip_extension.bzl
@@ -0,0 +1,19 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load(
+    "//bazel/versions:zip.version.bzl",
+    "ZIP_SHA256",
+    "ZIP_VERSION",
+)
+
+def _impl(module_ctx):
+    http_archive(
+        name = "zip",
+        build_file = ":files/zip.BUILD.bzl",
+        patch_args = ["-p1"],
+        patches = ["//bazel/patches:haskell/zip.patch"],
+        sha256 = ZIP_SHA256,
+        strip_prefix = "zip-{}".format(ZIP_VERSION),
+        urls = ["http://hackage.haskell.org/package/zip-{version}/zip-{version}.tar.gz".format(version = ZIP_VERSION)],
+    )
+
+zip = module_extension(implementation = _impl)
diff --git a/sdk/bazel/ghc-lib/BUILD b/sdk/bazel/ghc-lib/BUILD
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/bazel_tools/ghc-lib/README.md b/sdk/bazel/ghc-lib/README.md
similarity index 71%
rename from sdk/bazel_tools/ghc-lib/README.md
rename to sdk/bazel/ghc-lib/README.md
index 8d7273c17bd8..4803ca8858e6 100644
--- a/sdk/bazel_tools/ghc-lib/README.md
+++ b/sdk/bazel/ghc-lib/README.md
@@ -21,8 +21,8 @@ changes.
     ```
 - To build the Cabal libraries ghc-lib(-parser) use the following commands:
     ```
-    $ bazel build //bazel_tools/ghc-lib/ghc-lib-parser
-    $ bazel build //bazel_tools/ghc-lib/ghc-lib
+    $ bazel build //bazel/ghc-lib/ghc-lib-parser
+    $ bazel build //bazel/ghc-lib/ghc-lib
     ```
     or alternatively you can use the aliases exposed by `stack_snapshot`'s
     `vendored_packages`.
@@ -42,21 +42,15 @@ Note, an update of any of these may affect ghc-lib(-parser)'s Cabal files. If
 so, see below for updating the checked in Cabal files.
 
 - To update the GHC revision used to build ghc-lib change the `GHC_REV`
-  variable within `bazel_tools/ghc-lib/version.bzl`.
-  If needed update the patches listed within `GHC_PATCHES`, see below.
+  variable within `bazel/versions/da_ghc.version.bzl`.
 - To update the GHC version used to build ghc-lib also update the `GHC_FLAVOR`
-  and `GHC_LIB_VERSION` variables within `bazel_tools/ghc-lib/version.bzl`.
+  and `GHC_LIB_VERSION` variables within
+  `bazel/versions/da_ghc.version.bzl`.
 - To update the ghc-lib revision, which provides the `ghc-lib-gen` tool, change
   the `GHC_LIB_REV` and `GHC_LIB_SHA256` variables within
-  `bazel_tools/ghc-lib/version.bzl` and update the patches in `GHC_LIB_PATCHES`
-  if needed.
+  `bazel/versions/da_ghc.version.bzl`.
 - To update the checked in Cabal files execute the following Bazel commands.
     ```
-    $ bazel run //bazel_tools/ghc-lib/ghc-lib-parser:cabal-update
-    $ bazel run //bazel_tools/ghc-lib/ghc-lib:cabal-update
+    $ bazel run //bazel/ghc-lib/ghc-lib-parser:cabal-update
+    $ bazel run //bazel/ghc-lib/ghc-lib:cabal-update
     ```
-
-## Patches
-
-- `ghc-lib-no-stack.patch` patch `ghc-lib-gen` to use a prebuilt Hadrian binary.
-    With this change `ghc-lib-gen` no longer requires `stack`.
diff --git a/sdk/bazel_tools/ghc-lib/ghc-lib-parser/BUILD.bazel b/sdk/bazel/ghc-lib/ghc-lib-parser/BUILD.bazel
similarity index 85%
rename from sdk/bazel_tools/ghc-lib/ghc-lib-parser/BUILD.bazel
rename to sdk/bazel/ghc-lib/ghc-lib-parser/BUILD.bazel
index ce427c4eddae..737fd4c11fa2 100644
--- a/sdk/bazel_tools/ghc-lib/ghc-lib-parser/BUILD.bazel
+++ b/sdk/bazel/ghc-lib/ghc-lib-parser/BUILD.bazel
@@ -1,10 +1,7 @@
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
 load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_library")
 load("@stackage//:packages.bzl", "packages")
-load("//bazel_tools/ghc-lib:version.bzl", "GHC_LIB_VERSION")
+load("//bazel/versions:da_ghc.version.bzl", "GHC_LIB_VERSION")
 load("//bazel_tools:pkg.bzl", "unpack_tar")
 load(
     "//bazel_tools/sh:sh.bzl",
@@ -36,7 +33,7 @@ sh_inline_binary(
     name = "cabal-update",
     cmd = """\
 SOURCE=$$(canonicalize_rlocation $(rootpath @da-ghc//:ghc-lib-parser.cabal))
-OUTPUT_DIR=$$BUILD_WORKSPACE_DIRECTORY/bazel_tools/ghc-lib/ghc-lib-parser
+OUTPUT_DIR=$$BUILD_WORKSPACE_DIRECTORY/bazel/ghc-lib/ghc-lib-parser
 
 cp --no-preserve=mode -t "$$OUTPUT_DIR" "$$SOURCE"
 """,
@@ -76,7 +73,10 @@ haskell_cabal_library(
     srcs = [":srcs"],
     flags = packages["ghc-lib-parser"].flags,
     haddock = False,
-    tools = packages["ghc-lib-parser"].tools,
+    tools = [
+        "@stackage-exe//alex",
+        "@stackage-exe//happy",
+    ],
     version = packages["ghc-lib-parser"].version,
     visibility = ["//visibility:public"],
     deps = packages["ghc-lib-parser"].deps,
diff --git a/sdk/bazel_tools/ghc-lib/ghc-lib-parser/ghc-lib-parser.cabal b/sdk/bazel/ghc-lib/ghc-lib-parser/ghc-lib-parser.cabal
similarity index 100%
rename from sdk/bazel_tools/ghc-lib/ghc-lib-parser/ghc-lib-parser.cabal
rename to sdk/bazel/ghc-lib/ghc-lib-parser/ghc-lib-parser.cabal
diff --git a/sdk/bazel_tools/ghc-lib/ghc-lib/BUILD.bazel b/sdk/bazel/ghc-lib/ghc-lib/BUILD.bazel
similarity index 85%
rename from sdk/bazel_tools/ghc-lib/ghc-lib/BUILD.bazel
rename to sdk/bazel/ghc-lib/ghc-lib/BUILD.bazel
index 6113232c682e..c1107e1d2503 100644
--- a/sdk/bazel_tools/ghc-lib/ghc-lib/BUILD.bazel
+++ b/sdk/bazel/ghc-lib/ghc-lib/BUILD.bazel
@@ -1,10 +1,7 @@
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
 load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_library")
 load("@stackage//:packages.bzl", "packages")
-load("//bazel_tools/ghc-lib:version.bzl", "GHC_LIB_VERSION")
+load("//bazel/versions:da_ghc.version.bzl", "GHC_LIB_VERSION")
 load("//bazel_tools:pkg.bzl", "unpack_tar")
 load(
     "//bazel_tools/sh:sh.bzl",
@@ -36,7 +33,7 @@ sh_inline_binary(
     name = "cabal-update",
     cmd = """\
 SOURCE=$$(canonicalize_rlocation $(rootpath @da-ghc//:ghc-lib.cabal))
-OUTPUT_DIR=$$BUILD_WORKSPACE_DIRECTORY/bazel_tools/ghc-lib/ghc-lib
+OUTPUT_DIR=$$BUILD_WORKSPACE_DIRECTORY/bazel/ghc-lib/ghc-lib
 
 cp --no-preserve=mode -t "$$OUTPUT_DIR" "$$SOURCE"
 """,
@@ -76,7 +73,10 @@ haskell_cabal_library(
     srcs = [":srcs"],
     flags = packages["ghc-lib"].flags,
     haddock = False,
-    tools = packages["ghc-lib"].tools,
+    tools = [
+        "@stackage-exe//alex",
+        "@stackage-exe//happy",
+    ],
     version = packages["ghc-lib"].version,
     visibility = ["//visibility:public"],
     deps = packages["ghc-lib"].deps,
diff --git a/sdk/bazel_tools/ghc-lib/ghc-lib/ghc-lib.cabal b/sdk/bazel/ghc-lib/ghc-lib/ghc-lib.cabal
similarity index 100%
rename from sdk/bazel_tools/ghc-lib/ghc-lib/ghc-lib.cabal
rename to sdk/bazel/ghc-lib/ghc-lib/ghc-lib.cabal
diff --git a/sdk/bazel/patches/BUILD b/sdk/bazel/patches/BUILD
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/bazel/patches/go_googleapis/status-proto.patch b/sdk/bazel/patches/go_googleapis/status-proto.patch
new file mode 100644
index 000000000000..1ca75cb04013
--- /dev/null
+++ b/sdk/bazel/patches/go_googleapis/status-proto.patch
@@ -0,0 +1,12 @@
+diff --git a/google/rpc/BUILD.bazel b/google/rpc/BUILD.bazel
+index 8ffa5a49c..eb0a8127b 100644
+--- a/google/rpc/BUILD.bazel
++++ b/google/rpc/BUILD.bazel
+@@ -1,5 +1,7 @@
+ load("@rules_proto//proto:defs.bzl", "proto_library")
+ 
++exports_files(["status.proto", "error_details.proto"])
++
+ # This is an API workspace, having public visibility by default makes perfect sense.
+ package(default_visibility = ["//visibility:public"])
+ 
diff --git a/sdk/bazel_tools/ghc-lib/ghc-lib-no-stack.patch b/sdk/bazel/patches/haskell/ghc_lib_no_stack.patch
similarity index 100%
rename from sdk/bazel_tools/ghc-lib/ghc-lib-no-stack.patch
rename to sdk/bazel/patches/haskell/ghc_lib_no_stack.patch
diff --git a/sdk/bazel/patches/haskell/ghcide_binary_q.patch b/sdk/bazel/patches/haskell/ghcide_binary_q.patch
new file mode 100644
index 000000000000..05d61b2d0abd
--- /dev/null
+++ b/sdk/bazel/patches/haskell/ghcide_binary_q.patch
@@ -0,0 +1,20 @@
+diff --git a/src/Development/IDE/Core/Shake.hs b/src/Development/IDE/Core/Shake.hs
+index a471070..a2b3183 100644
+--- a/src/Development/IDE/Core/Shake.hs
++++ b/src/Development/IDE/Core/Shake.hs
+@@ -503,7 +503,14 @@ isBadDependency x
+ newtype Q k = Q (k, NormalizedFilePath)
+     deriving (Eq,Hashable,NFData, Generic)
+ 
+-instance Binary k => Binary (Q k)
++instance Binary k => Binary (Q k) where
++    put (Q (k, fp)) = put (k, fp)
++    get = do
++        (k, fp) <- get
++        -- The `get` implementation of NormalizedFilePath
++        -- does not handle empty file paths so we
++        -- need to handle this ourselves here.
++        pure (Q (k, toNormalizedFilePath' fp))
+ 
+ instance Show k => Show (Q k) where
+     show (Q (k, file)) = show k ++ "; " ++ fromNormalizedFilePath file
diff --git a/sdk/bazel/patches/haskell/lsp_types_expose_other_modules.patch b/sdk/bazel/patches/haskell/lsp_types_expose_other_modules.patch
new file mode 100644
index 000000000000..eafabbfcc91f
--- /dev/null
+++ b/sdk/bazel/patches/haskell/lsp_types_expose_other_modules.patch
@@ -0,0 +1,20 @@
+diff --git a/lsp-types.cabal b/lsp-types.cabal
+index 1af6907..1443cc0 100644
+--- a/lsp-types.cabal
++++ b/lsp-types.cabal
+@@ -21,6 +21,7 @@ library
+                      , Language.LSP.Types.Capabilities
+                      , Language.LSP.Types.Lens
+                      , Language.LSP.Types.SMethodMap
++                     , Language.LSP.Types.Utils
+                      , Language.LSP.VFS
+                      , Data.IxMap
+   other-modules:       Language.LSP.Types.CallHierarchy
+@@ -63,7 +64,6 @@ library
+                      , Language.LSP.Types.TextDocument
+                      , Language.LSP.Types.TypeDefinition
+                      , Language.LSP.Types.Uri
+-                     , Language.LSP.Types.Utils
+                      , Language.LSP.Types.Window
+                      , Language.LSP.Types.WatchedFiles
+                      , Language.LSP.Types.WorkspaceEdit
diff --git a/sdk/bazel/patches/haskell/lsp_types_normalisation.patch b/sdk/bazel/patches/haskell/lsp_types_normalisation.patch
new file mode 100644
index 000000000000..df2212488ee2
--- /dev/null
+++ b/sdk/bazel/patches/haskell/lsp_types_normalisation.patch
@@ -0,0 +1,44 @@
+diff --git a/src/Language/LSP/Types/Uri.hs b/src/Language/LSP/Types/Uri.hs
+index 8d2d43f..8477dde 100644
+--- a/src/Language/LSP/Types/Uri.hs
++++ b/src/Language/LSP/Types/Uri.hs
+@@ -112,12 +112,12 @@ platformAdjustFromUriPath systemOS authority srcPath =
+     else let
+       firstSegment:rest = (FPP.splitDirectories . tail) srcPath  -- Drop leading '/' for absolute Windows paths
+       drive = if FPW.isDrive firstSegment
+-              then FPW.addTrailingPathSeparator firstSegment
++              then FPP.addTrailingPathSeparator firstSegment
+               else firstSegment
+-      in FPW.joinDrive drive $ FPW.joinPath rest
++      in FPP.joinDrive drive $ FPP.joinPath rest
+ 
+ filePathToUri :: FilePath -> Uri
+-filePathToUri = (platformAwareFilePathToUri System.Info.os) . FP.normalise
++filePathToUri = (platformAwareFilePathToUri System.Info.os) . normalise'
+ 
+ {-# WARNING platformAwareFilePathToUri "This function is considered private. Use normalizedUriToFilePath instead." #-}
+ platformAwareFilePathToUri :: SystemOS -> FilePath -> Uri
+@@ -193,10 +193,22 @@ instance Hashable NormalizedFilePath where
+ instance IsString NormalizedFilePath where
+     fromString = toNormalizedFilePath
+ 
++-- | Normalise a file path, but always convert to POSIX style file paths.
++normalise' :: FilePath -> FilePath
++normalise' fp = nfp
++  where
++      (drv, nfp0) = FP.splitDrive fp
++      nfp = convertDrive drv `FPP.joinDrive` (FPP.joinPath $ FP.splitDirectories nfp0)
++
++      convertDrive drv
++        | System.Info.os == windowsOS && FPW.hasTrailingPathSeparator drv =
++            FPP.addTrailingPathSeparator (init drv)
++        | otherwise = drv
++
+ toNormalizedFilePath :: FilePath -> NormalizedFilePath
+ toNormalizedFilePath fp = normalizedFilePath nuri nfp
+   where
+-      nfp = FP.normalise fp
++      nfp = normalise' fp
+       nuri = internalNormalizedFilePathToUri nfp
+ 
+ fromNormalizedFilePath :: NormalizedFilePath -> FilePath
diff --git a/sdk/bazel/patches/haskell/zip.patch b/sdk/bazel/patches/haskell/zip.patch
new file mode 100644
index 000000000000..46440bbc72ef
--- /dev/null
+++ b/sdk/bazel/patches/haskell/zip.patch
@@ -0,0 +1,57 @@
+The use of temp files in `zip` sadly runs into an issue
+with GHC’s `openBinaryTempFile` function which seems
+to have a race condition where multiple processes can get
+the same temp file name. Then one process will move away the temp
+file of the other process resulting in the following error:
+
+damlc.exe: C:\users\\…\\ghc77D0.zip" Just "\\\\?\\C:\\users\\…\\daml-script-1.dev.dar": does not exist (The system cannot find the file specified.)
+
+We don’t need the atomic write of the zip (DAR) file here so
+we simply patch `zip` to write to the file directly.
+It doesn’t really make sense to upstream this. The code in the
+zip library is correct, it’s `openBinaryTempFile` that is broken.
+
+diff --git a/Codec/Archive/Zip/Internal.hs b/Codec/Archive/Zip/Internal.hs
+index b3fa27f..31e34b0 100644
+--- a/Codec/Archive/Zip/Internal.hs
++++ b/Codec/Archive/Zip/Internal.hs
+@@ -27,7 +27,6 @@ import Codec.Archive.Zip.CP437 (decodeCP437)
+ import Codec.Archive.Zip.Type
+ import Conduit (PrimMonad)
+ import Control.Applicative (many, (<|>))
+-import Control.Exception (bracketOnError, catchJust)
+ import Control.Monad
+ import Control.Monad.Catch (MonadThrow (..))
+ import Control.Monad.Trans.Maybe
+@@ -60,10 +59,7 @@ import Data.Version
+ import Data.Void
+ import Data.Word (Word16, Word32)
+ import Numeric.Natural (Natural)
+-import System.Directory
+-import System.FilePath
+ import System.IO
+-import System.IO.Error (isDoesNotExistError)
+ 
+ #ifndef mingw32_HOST_OS
+ import qualified Codec.Archive.Zip.Unix as Unix
+@@ -302,19 +298,7 @@ withNewFile ::
+   (Handle -> IO ()) ->
+   IO ()
+ withNewFile fpath action =
+-  bracketOnError allocate release $ \(path, h) -> do
+-    action h
+-    hClose h
+-    renameFile path fpath
+-  where
+-    allocate = openBinaryTempFile (takeDirectory fpath) ".zip"
+-    release (path, h) = do
+-      hClose h
+-      -- Despite using `bracketOnError` the file is not guaranteed to exist
+-      -- here since we could be interrupted with an async exception after
+-      -- the file has been renamed. Therefore, we silentely ignore
+-      -- `DoesNotExistError`.
+-      catchJust (guard . isDoesNotExistError) (removeFile path) (const $ pure ())
++  withBinaryFile fpath ReadWriteMode action
+ 
+ -- | Determine what comment in new archive will look like given its original
+ -- value and a collection of pending actions.
diff --git a/sdk/bazel_tools/haskell_proto3_suite_deriving_defaults.patch b/sdk/bazel/patches/proto3_suite/deriving_defaults.patch
similarity index 100%
rename from sdk/bazel_tools/haskell_proto3_suite_deriving_defaults.patch
rename to sdk/bazel/patches/proto3_suite/deriving_defaults.patch
diff --git a/sdk/bazel_tools/haskell_proto3_support_reserved_enums.patch b/sdk/bazel/patches/proto3_suite/support_reserved_enums.patch
similarity index 100%
rename from sdk/bazel_tools/haskell_proto3_support_reserved_enums.patch
rename to sdk/bazel/patches/proto3_suite/support_reserved_enums.patch
diff --git a/sdk/bazel/rules/BUILD b/sdk/bazel/rules/BUILD
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/bazel/rules/ghc_lib_sdist.bzl b/sdk/bazel/rules/ghc_lib_sdist.bzl
new file mode 100644
index 000000000000..8e81243a11e0
--- /dev/null
+++ b/sdk/bazel/rules/ghc_lib_sdist.bzl
@@ -0,0 +1,191 @@
+load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
+load("@rules_cc//cc:find_cc_toolchain.bzl", "find_cc_toolchain")
+load("//bazel/rules:install_gnu_tool.bzl", "InstalledGnuToolInfo")
+
+def _ghc_lib_sdist_impl(ctx):
+    component = ctx.attr.component
+    version = ctx.attr.version
+
+    # -- Outputs (predeclared via attr.output) --
+    cabal_file = ctx.outputs.cabal_out
+    tarball = ctx.outputs.tarball_out
+
+    # -- Haskell toolchain (GHC) --
+    hs_toolchain = ctx.toolchains["@rules_haskell//haskell:toolchain"]
+    ghc = hs_toolchain.tools.ghc
+    ghc_bindir = hs_toolchain.bindir
+    ghc_libdir = hs_toolchain.libdir
+
+    # -- CC toolchain (CC / LD) --
+    cc_toolchain = find_cc_toolchain(ctx)
+    feature_configuration = cc_common.configure_features(
+        ctx = ctx,
+        cc_toolchain = cc_toolchain,
+        requested_features = ctx.features,
+        unsupported_features = ctx.disabled_features,
+    )
+    cc = cc_common.get_tool_for_action(
+        feature_configuration = feature_configuration,
+        action_name = ACTION_NAMES.c_compile,
+    )
+    ld = cc_common.get_tool_for_action(
+        feature_configuration = feature_configuration,
+        action_name = ACTION_NAMES.cpp_link_executable,
+    )
+
+    # -- Autotools prefix (InstalledGnuToolInfo from install_gnu_tool) --
+    autotools_info = ctx.attr.autotools[InstalledGnuToolInfo]
+
+    # -- Perl binary --
+    perl_files = ctx.files.perl
+    perl_bin = [f for f in perl_files if f.basename == "perl"][0]
+
+    # -- Extra tools on PATH (e.g. happy, alex) --
+    extra_tool_path_entries = []
+    for tool in ctx.files.extra_tools:
+        extra_tool_path_entries.append('"$EXECROOT/{}"'.format(tool.dirname))
+
+    # -- cpp_options --
+    cpp_options = " ".join(["--cpp={}".format(cpp) for cpp in ctx.attr.cpp_options])
+
+    # -- Shell command --
+    shell_cmd = """\
+set -euo pipefail
+EXECROOT="$PWD"
+
+# Set up autotools from pre-built prefix tree.
+# The prefix contains __EXECROOT__ placeholders that must be fixed up.
+AUTOTOOLS_TMP=$(mktemp -d)
+cp -rL "$EXECROOT/{autotools_prefix}/." "$AUTOTOOLS_TMP/"
+find "$AUTOTOOLS_TMP" -type f | while IFS= read -r f; do
+    if file --mime-type "$f" | grep -q text; then
+        sed -i "s|__EXECROOT__/{autotools_prefix}|$AUTOTOOLS_TMP|g" "$f"
+        sed -i "s|__EXECROOT__|$EXECROOT|g" "$f"
+    fi
+done
+export PATH="$AUTOTOOLS_TMP/{autotools_bindir}:$PATH"
+
+# Tool paths
+export PATH="$(dirname "$EXECROOT/{ghc_path}"):$PATH"
+export PATH="$(dirname "$EXECROOT/{perl_path}"):$PATH"
+export PATH="$(dirname "$EXECROOT/{m4_path}"):$PATH"
+export PATH="$(dirname "$EXECROOT/{hadrian_path}"):$PATH"
+export PATH="$(dirname "$EXECROOT/{cabal_path}"):$PATH"
+{extra_tool_path}
+
+# Locale
+if [ "$(uname)" = "Darwin" ]; then
+    export LANG=en_US.UTF-8
+else
+    export LANG=C.UTF-8
+fi
+
+CC_PATH="{cc_path}"
+LD_PATH="{ld_path}"
+case "$CC_PATH" in /*) ;; *) CC_PATH="$EXECROOT/$CC_PATH" ;; esac
+case "$LD_PATH" in /*) ;; *) LD_PATH="$EXECROOT/$LD_PATH" ;; esac
+export CC="$CC_PATH"
+export LD="$LD_PATH"
+
+# Copy GHC source tree to a writable temp directory
+GHC_DIR="$EXECROOT/{ghc_src_dir}"
+TMP=$(mktemp -d)
+trap "rm -rf $TMP $AUTOTOOLS_TMP" EXIT
+cp -rLt $TMP $GHC_DIR/.
+export HOME="$TMP"
+
+# Generate ghc-lib{component} cabal project
+$EXECROOT/{ghc_lib_gen_path} $TMP \
+    --ghc-lib{component} \
+    --ghc-flavor={ghc_flavor} \
+    {cpp_options}
+
+# Remove absolute paths to the execroot from GHC settings
+sed -i.bak \
+    -e "s#$EXECROOT/##" \
+    $TMP/ghc-lib/stage0/lib/settings
+
+# Patch the ghc-lib version
+sed -i.bak \
+    -e 's#version: 0.1.0#version: {version}#' \
+    $TMP/ghc-lib{component}.cabal
+
+# Copy cabal file to declared output
+cp $TMP/ghc-lib{component}.cabal $EXECROOT/{cabal_output}
+
+# Create source distribution tarball
+(cd $TMP; $EXECROOT/{cabal_path} sdist -o $EXECROOT/{output_dir})
+""".format(
+        autotools_prefix = autotools_info.prefix.path,
+        autotools_bindir = autotools_info.bindir,
+        ghc_path = ghc.path,
+        perl_path = perl_bin.path,
+        m4_path = ctx.file.m4.path,
+        hadrian_path = ctx.executable.hadrian.path,
+        cabal_path = ctx.file.cabal.path,
+        ghc_lib_gen_path = ctx.executable.ghc_lib_gen.path,
+        extra_tool_path = "\n".join(
+            ['export PATH={}:"$PATH"'.format(d) for d in extra_tool_path_entries]
+        ),
+        cc_path = cc,
+        ld_path = ld,
+        ghc_src_dir = ctx.file.readme.dirname,
+        component = component,
+        version = version,
+        ghc_flavor = ctx.attr.ghc_flavor,
+        cpp_options = cpp_options,
+        cabal_output = cabal_file.path,
+        output_dir = tarball.dirname,
+    )
+
+    # -- Action --
+    ctx.actions.run_shell(
+        outputs = [cabal_file, tarball],
+        inputs = depset(
+            direct = [
+                ctx.file.readme,
+                autotools_info.prefix,
+                ctx.file.m4,
+                ctx.file.cabal,
+                perl_bin,
+            ] + ctx.files.ghc_srcs + ctx.files.perl + ghc_bindir + ghc_libdir + ctx.files.extra_tools,
+            transitive = [cc_toolchain.all_files],
+        ),
+        tools = [
+            ctx.executable.ghc_lib_gen,
+            ctx.executable.hadrian,
+        ],
+        command = shell_cmd,
+        mnemonic = "GhcLibSdist",
+        progress_message = "Generating ghc-lib%s sdist" % component,
+        use_default_shell_env = False,
+    )
+
+    return [DefaultInfo(files = depset([cabal_file, tarball]))]
+
+ghc_lib_sdist = rule(
+    implementation = _ghc_lib_sdist_impl,
+    attrs = {
+        "ghc_srcs": attr.label(mandatory = True),
+        "readme": attr.label(mandatory = True, allow_single_file = True),
+        "ghc_lib_gen": attr.label(mandatory = True, executable = True, cfg = "exec"),
+        "hadrian": attr.label(mandatory = True, executable = True, cfg = "exec"),
+        "autotools": attr.label(mandatory = True, providers = [InstalledGnuToolInfo]),
+        "m4": attr.label(mandatory = True, allow_single_file = True),
+        "perl": attr.label(mandatory = True),
+        "cabal": attr.label(mandatory = True, allow_single_file = True),
+        "component": attr.string(default = "", values = ["", "-parser"]),
+        "version": attr.string(mandatory = True),
+        "ghc_flavor": attr.string(mandatory = True),
+        "extra_tools": attr.label_list(allow_files = True, doc = "Additional tool binaries needed on PATH (e.g. happy, alex)."),
+        "cpp_options": attr.string_list(default = []),
+        "cabal_out": attr.output(mandatory = True, doc = "Declared output for the .cabal file."),
+        "tarball_out": attr.output(mandatory = True, doc = "Declared output for the sdist tarball."),
+        "_cc_toolchain": attr.label(default = "@rules_cc//cc:current_cc_toolchain"),
+    },
+    toolchains = [
+        "@rules_haskell//haskell:toolchain",
+        "@rules_cc//cc:toolchain_type",
+    ],
+    fragments = ["cpp"],
+)
diff --git a/sdk/bazel/rules/install_gnu_tool.bzl b/sdk/bazel/rules/install_gnu_tool.bzl
new file mode 100644
index 000000000000..eb74475c126c
--- /dev/null
+++ b/sdk/bazel/rules/install_gnu_tool.bzl
@@ -0,0 +1,135 @@
+InstalledGnuToolInfo = provider(
+    doc = "Paths within a GNU tool install prefix.",
+    fields = {
+        "prefix": "The directory tree artifact containing the installed tool.",
+        "bindir": "Relative path to bin/ within prefix.",
+        "datadir": "Relative path to share/ within prefix.",
+    },
+)
+
+def _install_gnu_tool_impl(ctx):
+    prefix_dir = ctx.actions.declare_directory(ctx.attr.name + "_prefix")
+
+    configure_src = ctx.file.configure
+    perl_files = ctx.files.perl
+    perl_bin = [f for f in perl_files if f.basename == "perl"][0]
+
+    extra_path_entries = [
+        "$EXECROOT/" + f.dirname
+        for f in ctx.files.extra_tools
+    ]
+
+    m4_env_line = ""
+    for f in ctx.files.extra_tools:
+        if f.basename == "m4":
+            m4_env_line = 'export M4="$EXECROOT/{}"'.format(f.path)
+
+    # Build additional source packages before the main one. Each entry
+    # is built via ./configure && make install into the shared prefix
+    # so that all tools share consistent internal paths.
+    pre_build_steps = []
+    for dep_src in ctx.attr.pre_build_srcs:
+        dep_files = dep_src.files.to_list()
+        dep_configure = None
+        for f in dep_files:
+            if f.basename == "configure" and f.dirname.count("/") == dep_files[0].dirname.count("/"):
+                dep_configure = f
+                break
+        if dep_configure:
+            pre_build_steps.append("""\
+echo "=== Pre-building from {src_dir} ==="
+cd "$EXECROOT/$(dirname {configure})"
+PERL="$PERL" ./configure --prefix="$PREFIX"
+make -j$(nproc) install
+cd "$EXECROOT"
+""".format(configure = dep_configure.path, src_dir = dep_configure.dirname))
+
+    path_str = ":".join(extra_path_entries)
+
+    all_srcs = ctx.files.srcs + ctx.files.extra_tools + perl_files
+    for dep_src in ctx.attr.pre_build_srcs:
+        all_srcs = all_srcs + dep_src.files.to_list()
+
+    inputs = depset(direct = all_srcs)
+
+    ctx.actions.run_shell(
+        outputs = [prefix_dir],
+        inputs = inputs,
+        command = """\
+set -euo pipefail
+EXECROOT="$PWD"
+PERL="$EXECROOT/{perl}"
+PREFIX="$EXECROOT/{output}"
+SRC="$EXECROOT/$(dirname {configure})"
+EXTRA_PATH="{extra_path}"
+
+export PATH="$PREFIX/bin:$(dirname $PERL):$EXTRA_PATH:$PATH"
+{m4_env}
+
+{pre_build_steps}
+
+echo "=== Building main package ==="
+cd "$SRC"
+PERL="$PERL" ./configure --prefix="$PREFIX"
+make -j$(nproc) install
+
+# Fix shebangs to be relocatable (use env perl instead of hardcoded path).
+for f in "$PREFIX/bin/"*; do
+    [ -f "$f" ] || continue
+    if head -1 "$f" | grep -q perl; then
+        sed -i '1s|#!.*perl.*|#!/usr/bin/env perl|' "$f"
+    fi
+done
+
+# Replace all hardcoded sandbox-absolute paths with a relocatable placeholder.
+# Autotools bakes the absolute install prefix, perl path, and m4 path into
+# scripts and config files.  Replacing the common execroot prefix lets the
+# consumer do a single: sed 's|__EXECROOT__|'"$PWD"'|g' to fix everything,
+# since execroot-relative artifact paths are stable across sandboxes.
+find "$PREFIX" -type f | while IFS= read -r pf; do
+    if file --mime-type "$pf" | grep -q text; then
+        sed -i "s|$EXECROOT|__EXECROOT__|g" "$pf"
+    fi
+done
+""".format(
+            configure = configure_src.path,
+            perl = perl_bin.path,
+            output = prefix_dir.path,
+            extra_path = path_str,
+            m4_env = m4_env_line,
+            pre_build_steps = "\n".join(pre_build_steps),
+        ),
+        mnemonic = "InstallGnuTool",
+        progress_message = "Building %s from source" % ctx.label,
+        use_default_shell_env = False,
+    )
+
+    return [
+        DefaultInfo(files = depset([prefix_dir])),
+        InstalledGnuToolInfo(
+            prefix = prefix_dir,
+            bindir = "bin",
+            datadir = "share",
+        ),
+    ]
+
+install_gnu_tool = rule(
+    implementation = _install_gnu_tool_impl,
+    attrs = {
+        "srcs": attr.label(mandatory = True, doc = "Source tree filegroup."),
+        "configure": attr.label(
+            mandatory = True,
+            allow_single_file = True,
+            doc = "The configure script for the main package.",
+        ),
+        "perl": attr.label(mandatory = True, doc = "Perl toolchain files."),
+        "extra_tools": attr.label_list(
+            allow_files = True,
+            doc = "Additional tool binaries needed on PATH during build (individual files).",
+        ),
+        "pre_build_srcs": attr.label_list(
+            doc = "Source trees to build and install before the main package. " +
+                  "Each must contain a configure script at its root.",
+        ),
+    },
+)
diff --git a/sdk/bazel/rules/patches/BUILD b/sdk/bazel/rules/patches/BUILD
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/bazel/versions/BUILD b/sdk/bazel/versions/BUILD
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/bazel/versions/cabal.version.bzl b/sdk/bazel/versions/cabal.version.bzl
new file mode 100644
index 000000000000..8ad7ba7eca5a
--- /dev/null
+++ b/sdk/bazel/versions/cabal.version.bzl
@@ -0,0 +1,30 @@
+# -- cabal-install --
+# https://www.haskell.org/cabal/
+CABAL_INSTALL_VERSION = "3.10.3.0"
+
+_BASE_URL = "https://downloads.haskell.org/~cabal/cabal-install-{v}/cabal-install-{v}".format(
+    v = CABAL_INSTALL_VERSION,
+)
+
+CABAL_PLATFORMS = {
+    "linux-x86_64": {
+        "url": _BASE_URL + "-x86_64-linux-deb10.tar.xz",
+        "sha256": "1d7a7131402295b01f25be5373fde095a404c45f9b5a5508fb7474bb0d3d057a",
+    },
+    "linux-aarch64": {
+        "url": _BASE_URL + "-aarch64-linux-deb10.tar.xz",
+        "sha256": "92d341620c60294535f03098bff796ef6de2701de0c4fcba249cde18a2923013",
+    },
+    "darwin-x86_64": {
+        "url": _BASE_URL + "-x86_64-darwin.tar.xz",
+        "sha256": "3aed78619b2164dd61eb61afb024073ae2c50f6655fa60fcc1080980693e3220",
+    },
+    "darwin-aarch64": {
+        "url": _BASE_URL + "-aarch64-darwin.tar.xz",
+        "sha256": "f4f606b1488a4b24c238f7e09619959eed89c550ed8f8478b350643f652dc08c",
+    },
+    "windows-x86_64": {
+        "url": _BASE_URL + "-x86_64-windows.zip",
+        "sha256": "b651ca732998eba5c0e54f4329c147664a7fb3fe3e74eac890c31647ce1e179a",
+    },
+}
diff --git a/sdk/bazel/versions/d3plus.version.bzl b/sdk/bazel/versions/d3plus.version.bzl
new file mode 100644
index 000000000000..845868fc9a7f
--- /dev/null
+++ b/sdk/bazel/versions/d3plus.version.bzl
@@ -0,0 +1,4 @@
+# -- d3plus --
+# https://github.com/alexandersimoes/d3plus
+D3PLUS_VERSION = "1.9.8"
+D3PLUS_SHA256 = "7d31a500a4850364a966ac938eea7f2fa5ce1334966b52729079490636e7049a"
diff --git a/sdk/bazel_tools/ghc-lib/version.bzl b/sdk/bazel/versions/da_ghc.version.bzl
similarity index 57%
rename from sdk/bazel_tools/ghc-lib/version.bzl
rename to sdk/bazel/versions/da_ghc.version.bzl
index 9e4c34bef79a..60ca54dbe805 100644
--- a/sdk/bazel_tools/ghc-lib/version.bzl
+++ b/sdk/bazel/versions/da_ghc.version.bzl
@@ -1,20 +1,15 @@
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
+# -- ghc-lib-gen (provides the ghc-lib-gen tool) --
+# https://github.com/digital-asset/ghc-lib
 GHC_LIB_REPO_URL = "https://github.com/digital-asset/ghc-lib"
 GHC_LIB_REV = "b503248db52d6049d18a9dbfa31e0f11aef71df7"
 GHC_LIB_SHA256 = "2d677bd4bfe6c91fd989551b0821b87b48ab49473a747f548cb58766f9636c11"
-GHC_LIB_PATCHES = [
-    "@//bazel_tools/ghc-lib:ghc-lib-no-stack.patch",
-]
 
+# -- da-ghc (GHC source tree for sdist generation) --
+# https://github.com/digital-asset/ghc
 GHC_REPO_URL = "https://github.com/digital-asset/ghc"
 GHC_REV = "205ab2e4f456dcf28166160df38dd9f0fe067df9"
-GHC_PATCHES = [
-]
 
+# -- ghc-lib build parameters --
 GHC_FLAVOR = "da-ghc-8.8.1"
 GHC_LIB_VERSION = "8.8.1"
-GHC_CPP_OPTIONS = [
-    "-DDAML_PRIM",
-]
+GHC_CPP_OPTIONS = ["-DDAML_PRIM"]
diff --git a/sdk/bazel/versions/dpm.version.bzl b/sdk/bazel/versions/dpm.version.bzl
new file mode 100644
index 000000000000..0ab371112039
--- /dev/null
+++ b/sdk/bazel/versions/dpm.version.bzl
@@ -0,0 +1,9 @@
+# -- dpm (Daml Package Manager) --
+DPM_VERSION = "1.0.8"
+DPM_SHA256 = {
+    "linux_arm64": "0a108513d99d3f996282ed85c51dc6c10b5790737a299182671c450f87cdf851",
+    "darwin_amd64": "edfeeec2ea7ac5eb03b56cc2a912ebc59d4ff9db9831cfa0b6033def218aa637",
+    "darwin_arm64": "ed9c7c6724efc36ca39cf5193a87a73e146685ae2dd042580ee20ca685aa0e1e",
+    "linux_amd64": "49dcc18c5dbea13bda52f6668b5831b53b46d209e1e539a1ef2a5553c3df6c09",
+    "windows_amd64": "594ac706c4eff9f0779d0cf04c18cda5ea8f6e4cf82fbead3f03f6aa7de423f9",
+}
diff --git a/sdk/bazel/versions/ghcide.version.bzl b/sdk/bazel/versions/ghcide.version.bzl
new file mode 100644
index 000000000000..f7509c0f2a54
--- /dev/null
+++ b/sdk/bazel/versions/ghcide.version.bzl
@@ -0,0 +1,5 @@
+# -- daml-ghcide --
+# https://github.com/digital-asset/daml-ghcide
+GHCIDE_REPO_URL = "https://github.com/digital-asset/daml-ghcide"
+GHCIDE_REV = "2914f9328dc549bd4918c3cf0fc008690a102d70"
+GHCIDE_SHA256 = "bc2bd2fbfbfb501e303b35fb4b2f503b122e4eb0aff34472f0e882d2289afc57"
diff --git a/sdk/bazel/versions/gnu_tools.version.bzl b/sdk/bazel/versions/gnu_tools.version.bzl
new file mode 100644
index 000000000000..8c9d023bdc82
--- /dev/null
+++ b/sdk/bazel/versions/gnu_tools.version.bzl
@@ -0,0 +1,19 @@
+# -- autoconf --
+# https://ftp.gnu.org/gnu/autoconf/
+AUTOCONF_VERSION = "2.72"
+AUTOCONF_SHA256 = "afb181a76e1ee72832f6581c0eddf8df032b83e2e0239ef79ebedc4467d92d6e"
+
+# -- automake --
+# https://ftp.gnu.org/gnu/automake/
+AUTOMAKE_VERSION = "1.16.5"
+AUTOMAKE_SHA256 = "07bd24ad08a64bc17250ce09ec56e921d6343903943e99ccf63bbf0705e34605"
+
+# -- m4 --
+# https://ftp.gnu.org/gnu/m4/
+M4_VERSION = "1.4.19"
+M4_SHA256 = "3be4a26d825ffdfda52a56fc43246456989a3630093cced3fbddf4771ee58a70"
+
+# -- ncurses --
+# https://ftp.gnu.org/gnu/ncurses/
+NCURSES_VERSION = "6.4"
+NCURSES_SHA256 = "6931283d9ac87c5073f30b6290c4c75f21632bb4fc3603ac8100812bed248159"
diff --git a/sdk/bazel/versions/googleapis.version.bzl b/sdk/bazel/versions/googleapis.version.bzl
new file mode 100644
index 000000000000..47e7e92da461
--- /dev/null
+++ b/sdk/bazel/versions/googleapis.version.bzl
@@ -0,0 +1,4 @@
+# -- googleapis --
+# https://github.com/googleapis/googleapis
+GOOGLEAPIS_VERSION = "83c3605afb5a39952bf0a0809875d41cf2a558ca"
+GOOGLEAPIS_SHA256 = "ba694861340e792fd31cb77274eacaf6e4ca8bda97707898f41d8bebfd8a4984"
diff --git a/sdk/bazel/versions/grpc_java.version.bzl b/sdk/bazel/versions/grpc_java.version.bzl
new file mode 100644
index 000000000000..21acfb1d696f
--- /dev/null
+++ b/sdk/bazel/versions/grpc_java.version.bzl
@@ -0,0 +1,4 @@
+# -- grpc-java --
+# https://github.com/grpc/grpc-java
+GRPC_JAVA_VERSION = "1.60.2"
+GRPC_JAVA_SHA256 = "4baf80f35488739d99515d71b8e72bd17a476c214a84106edc66b259fe8ac22c"
diff --git a/sdk/bazel/versions/lsp_types.version.bzl b/sdk/bazel/versions/lsp_types.version.bzl
new file mode 100644
index 000000000000..5d068c621bd9
--- /dev/null
+++ b/sdk/bazel/versions/lsp_types.version.bzl
@@ -0,0 +1,4 @@
+# -- lsp-types (Haskell package) --
+# http://hackage.haskell.org/package/lsp-types
+LSP_TYPES_VERSION = "1.4.0.0"
+LSP_TYPES_SHA256 = "7ae8a3bad0e91d4a2af9b93e3ad207e3f4c3dace40d420e0592f6323ac93fb67"
diff --git a/sdk/bazel/versions/proto3_suite.version.bzl b/sdk/bazel/versions/proto3_suite.version.bzl
new file mode 100644
index 000000000000..cfd43bed65f0
--- /dev/null
+++ b/sdk/bazel/versions/proto3_suite.version.bzl
@@ -0,0 +1,4 @@
+# -- proto3-suite --
+# https://github.com/awakesecurity/proto3-suite
+PROTO3SUITE_VERSION = "0.5.1"
+PROTO3SUITE_SHA256 = "6e6d514867e8efe90fe6a7e5167b86260da00fdb7ef335af694295a1adde57f4"
diff --git a/sdk/bazel/versions/protoc.version.bzl b/sdk/bazel/versions/protoc.version.bzl
new file mode 100644
index 000000000000..150a5da1ce5b
--- /dev/null
+++ b/sdk/bazel/versions/protoc.version.bzl
@@ -0,0 +1,12 @@
+# -- protoc (prebuilt binary) --
+# https://github.com/protocolbuffers/protobuf/releases/tag/v25.5
+# Must stay aligned with Maven's com.google.protobuf:protobuf-java:3.25.5
+PROTOC_VERSION = "25.5"
+
+PROTOC_SHA256S = {
+    "linux-x86_64": "e1ed237a17b2e851cf9662cb5ad02b46e70ff8e060e05984725bc4b4228c6b28",
+    "linux-aarch_64": "dc715bb5aab2ebf9653d7d3efbe55e01a035e45c26f391ff6d9b7923e22914b7",
+    "osx-x86_64": "c5447e4f0d5caffb18d9ff21eae7bc7faf2bb2000083d6f49e5b6000b30fceae",
+    "osx-aarch_64": "781a6fc4c265034872cadc65e63dd3c0fc49245b70917821b60e2d457a6876ab",
+    "win64": "d2861b0e3131660e5522d0f348dd95e656a5d35f37554c5c2722190ce4b0000b",
+}
diff --git a/sdk/bazel/versions/zip.version.bzl b/sdk/bazel/versions/zip.version.bzl
new file mode 100644
index 000000000000..c4813d418499
--- /dev/null
+++ b/sdk/bazel/versions/zip.version.bzl
@@ -0,0 +1,4 @@
+# -- zip (Haskell package) --
+# http://hackage.haskell.org/package/zip
+ZIP_VERSION = "1.7.1"
+ZIP_SHA256 = "0d7f02bbdf6c49e9a33d2eca4b3d7644216a213590866dafdd2b47ddd38eb746"
diff --git a/sdk/bazel_tools/ghc-lib/BUILD.bazel b/sdk/bazel_tools/ghc-lib/BUILD.bazel
deleted file mode 100644
index ed61ec41348e..000000000000
--- a/sdk/bazel_tools/ghc-lib/BUILD.bazel
+++ /dev/null
@@ -1,44 +0,0 @@
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
-load("@rules_sh//sh:sh.bzl", "sh_binaries")
-load("@os_info//:os_info.bzl", "is_windows")
-load("//bazel_tools:bundle.bzl", "cc_toolchain_binary_bundle", "library_bundle")
-
-sh_library(
-    name = "sh-lib",
-    srcs = ["lib.sh"],
-    visibility = ["@da-ghc//:__pkg__"],
-)
-
-cc_toolchain_binary_bundle(
-    name = "cc-tools",
-)
-
-sh_binaries(
-    name = "tools-windows",
-    deps = [
-        "@cabal_win//:tools",
-        "@dadew_ghc_lib_deps_git//:tools",
-        "@dadew_ghc_lib_deps_msys2//:tools",
-        "@dadew_ghc_lib_deps_python//:tools",
-        "@ghc_win//:tools",
-    ],
-) if is_windows else None
-
-sh_binaries(
-    name = "tools",
-    srcs = [
-        "@stackage-exe//alex",
-        "@stackage-exe//happy",
-    ],
-    visibility = ["@da-ghc//:__pkg__"],
-    deps = [":cc-tools"] +
-           ([":tools-windows"] if is_windows else ["@nix_ghc_lib_deps//:tools"]),
-)
-
-library_bundle(
-    name = "libs",
-    visibility = ["@da-ghc//:__pkg__"],
-    deps = [] if is_windows else ["@nix_ghc_lib_deps//:libs"],
-)
diff --git a/sdk/bazel_tools/ghc-lib/BUILD.ghc b/sdk/bazel_tools/ghc-lib/BUILD.ghc
deleted file mode 100644
index 8c17a573e420..000000000000
--- a/sdk/bazel_tools/ghc-lib/BUILD.ghc
+++ /dev/null
@@ -1,7 +0,0 @@
-load("@com_github_digital_asset_daml//bazel_tools/ghc-lib:defs.bzl", "ghc")
-
-# Note, we use this indirection to avoid a re-fetch of the GHC repository on
-# changes of the build definitions.
-# See https://docs.bazel.build/versions/main/external.html#caching-of-external-dependencies
-# > Changes to files referenced in the definition (e.g., patches or BUILD files) are also taken into account by bazel.
-ghc()
diff --git a/sdk/bazel_tools/ghc-lib/BUILD.ghc-lib-gen b/sdk/bazel_tools/ghc-lib/BUILD.ghc-lib-gen
deleted file mode 100644
index fa95a479385c..000000000000
--- a/sdk/bazel_tools/ghc-lib/BUILD.ghc-lib-gen
+++ /dev/null
@@ -1,6 +0,0 @@
-load("@com_github_digital_asset_daml//bazel_tools/ghc-lib:defs.bzl", "ghc_lib_gen")
-
-# Note, we use this indirection to avoid a re-fetch of the ghc-lib repository
-# on changes of the build definitions.
-# See https://docs.bazel.build/versions/main/external.html#caching-of-external-dependencies
-ghc_lib_gen()
diff --git a/sdk/bazel_tools/ghc-lib/BUILD.nix-deps b/sdk/bazel_tools/ghc-lib/BUILD.nix-deps
deleted file mode 100644
index 7d3b6905b721..000000000000
--- a/sdk/bazel_tools/ghc-lib/BUILD.nix-deps
+++ /dev/null
@@ -1,57 +0,0 @@
-load("@rules_sh//sh:sh.bzl", "sh_binaries")
-load("@com_github_digital_asset_daml//bazel_tools:bundle.bzl", "library_bundle")
-
-package(default_visibility = ["//visibility:public"])
-
-sh_binaries(
-    name = "tools",
-    srcs = glob(["bin/*"]),
-)
-
-library_bundle(
-    name = "libs",
-    libs = [
-        "libtinfo",
-        "libncurses",
-        "libncursesw",
-        "libform",
-        "libformw",
-        "libmenu",
-        "libmenuw",
-        "libpanel",
-        "libpanelw",
-    ],
-)
-
-cc_library(
-    name = "libtinfo",
-    srcs = glob(["lib/libtinfo.*"]),
-)
-
-[
-    cc_library(
-        name = "libncurses{}".format(w),
-        srcs = glob(["lib/libncurses{}.*".format(w)]),
-    )
-    for w in [
-        "",
-        "w",
-    ]
-]
-
-[
-    cc_library(
-        name = "lib{}{}".format(name, w),
-        srcs = glob(["lib/lib{}{}.*".format(name, w)]),
-        deps = [":libncurses{}".format(w)],
-    )
-    for name in [
-        "form",
-        "menu",
-        "panel",
-    ]
-    for w in [
-        "",
-        "w",
-    ]
-]
diff --git a/sdk/bazel_tools/ghc-lib/defs.bzl b/sdk/bazel_tools/ghc-lib/defs.bzl
deleted file mode 100644
index eb82f5c6310d..000000000000
--- a/sdk/bazel_tools/ghc-lib/defs.bzl
+++ /dev/null
@@ -1,153 +0,0 @@
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
-load("@os_info//:os_info.bzl", "is_darwin")
-load("@rules_haskell//haskell:cabal.bzl", "haskell_cabal_binary", "haskell_cabal_library")
-load(":version.bzl", "GHC_CPP_OPTIONS", "GHC_FLAVOR", "GHC_LIB_VERSION")
-
-def ghc_lib_gen():
-    """Build the ghc-lib-gen binary provided ghc-lib."""
-    native.filegroup(
-        name = "srcs",
-        srcs = native.glob(["**"]),
-        visibility = ["//visibility:public"],
-    )
-    haskell_cabal_library(
-        name = "ghc-lib-gen-lib",
-        package_name = "ghc-lib-gen",
-        version = "0.1.0.0",
-        haddock = False,
-        srcs = [":srcs"],
-        deps = [
-            "@stackage//:base",
-            "@stackage//:process",
-            "@stackage//:filepath",
-            "@stackage//:containers",
-            "@stackage//:directory",
-            "@stackage//:optparse-applicative",
-            "@stackage//:bytestring",
-            "@stackage//:yaml",
-            "@stackage//:aeson",
-            "@stackage//:text",
-            "@stackage//:unordered-containers",
-            "@stackage//:extra",
-        ],
-    )
-    haskell_cabal_binary(
-        name = "ghc-lib-gen",
-        srcs = [":srcs"],
-        deps = [
-            ":ghc-lib-gen-lib",
-            "@stackage//:base",
-            "@stackage//:containers",
-            "@stackage//:directory",
-            "@stackage//:extra",
-            "@stackage//:filepath",
-            "@stackage//:optparse-applicative",
-            "@stackage//:process",
-        ],
-        visibility = ["//visibility:public"],
-    )
-
-def ghc():
-    """Build the ghc-lib(-parser) sdist from GHC using ghc-lib-gen.
-
-    Builds `hadrian` with Bazel and exposes it as a ready-made tool into the
-    `genrule`s that create the Cabal sdists.
-    """
-    native.filegroup(
-        name = "hadrian-srcs",
-        srcs = native.glob(["hadrian/**"]),
-        visibility = ["//visibility:public"],
-    )
-    haskell_cabal_binary(
-        name = "hadrian",
-        flags = ["with_bazel"],
-        srcs = [":hadrian-srcs"],
-        deps = [
-            "@stackage//:base",
-            "@stackage//:Cabal",
-            "@stackage//:containers",
-            "@stackage//:directory",
-            "@stackage//:extra",
-            "@stackage//:mtl",
-            "@stackage//:parsec",
-            "@stackage//:QuickCheck",
-            "@stackage//:shake",
-            "@stackage//:transformers",
-            "@stackage//:unordered-containers",
-        ],
-        tools = [
-            "@stackage-exe//alex",
-            "@stackage-exe//happy",
-        ],
-        cabalopts = [
-            "--ghc-option=-Wno-dodgy-imports",
-            "--ghc-option=-Wno-unused-imports",
-        ],
-    )
-    native.filegroup(
-        name = "srcs",
-        srcs = native.glob(["**"]),
-        visibility = ["//visibility:public"],
-    )
-    for component in ["", "-parser"]:
-        native.genrule(
-            name = "ghc-lib{}".format(component),
-            srcs = [
-                ":srcs",
-                ":README.md",
-            ],
-            tools = [
-                "@ghc-lib-gen",
-                "@//bazel_tools/ghc-lib:sh-lib",
-                ":hadrian",
-            ],
-            toolchains = [
-                "@rules_cc//cc:current_cc_toolchain",
-                "@//bazel_tools/ghc-lib:libs",
-                "@//bazel_tools/ghc-lib:tools",
-            ],
-            outs = [
-                "ghc-lib{}.cabal".format(component),
-                "ghc-lib{}-{}.tar.gz".format(component, GHC_LIB_VERSION),
-            ],
-            cmd = """\
-set -euo pipefail
-EXECROOT=$$PWD
-. $(execpath @//bazel_tools/ghc-lib:sh-lib)
-
-SEP="$$(path_list_separtor)"
-export LIBRARY_PATH="$$(make_all_absolute "$(LIBS_LIBRARY_PATH)")"
-export PATH="$$(make_all_absolute "$(_TOOLS_PATH)")$$SEP$$PATH"
-export PATH="$$(abs_dirname "$(execpath :hadrian)")$$SEP$$PATH"
-export LANG={lang}
-export CC="$$(make_absolute $(CC))"
-export LD="$$(make_absolute $(LD))"
-
-GHC="$$(abs_dirname $(execpath :README.md))"
-TMP=$$(mktemp -d)
-trap "rm -rf $$TMP" EXIT
-cp -rLt $$TMP $$GHC/.
-export HOME="$$TMP"
-
-$(execpath @ghc-lib-gen) $$TMP --ghc-lib{component} --ghc-flavor={ghc_flavor} {cpp_options}
-# Remove absolute paths to the execroot.
-sed -i.bak \\
-  -e "s#$$EXECROOT/##" \\
-  $$TMP/ghc-lib/stage0/lib/settings
-# Patch the ghc-lib version.
-sed -i.bak \\
-  -e 's#version: 0.1.0#version: {ghc_lib_version}#' \\
-  $$TMP/ghc-lib{component}.cabal
-cp $$TMP/ghc-lib{component}.cabal $(execpath ghc-lib{component}.cabal)
-(cd $$TMP; cabal sdist -o $$EXECROOT/$(RULEDIR))
-""".format(
-                component = component,
-                ghc_flavor = GHC_FLAVOR,
-                ghc_lib_version = GHC_LIB_VERSION,
-                lang = "en_US.UTF-8" if is_darwin else "C.UTF-8",
-                cpp_options = " ".join(["--cpp={}".format(cpp) for cpp in GHC_CPP_OPTIONS]),
-            ),
-            visibility = ["//visibility:public"],
-        )
diff --git a/sdk/bazel_tools/ghc-lib/lib.sh b/sdk/bazel_tools/ghc-lib/lib.sh
deleted file mode 100644
index ddd76ee260d8..000000000000
--- a/sdk/bazel_tools/ghc-lib/lib.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
-is_windows() {
-  case "$OSTYPE" in
-    win*) return 0;;
-    msys*) return 0;;
-    cygwin*) return 0;;
-    *) return 1;;
-  esac
-}
-
-path_list_separtor() {
-  # Use ':' even on Windows because msys2 will automatically convert such
-  # path lists to the Windows format, using ';' as separator and 'C:\'
-  # syntax. Be sure that absolute paths use the format '/c/...' instead of
-  # 'C:\...'. See https://www.msys2.org/docs/filesystem-paths/.
-  if is_windows; then
-    echo ":"
-  else
-    echo ":"
-  fi
-}
-
-make_absolute() {
-  local P="$1"
-  case "$P" in
-    /*|[a-zA-Z]:/*|[a-zA-Z]:\\*) echo "$P";;
-    *) echo "$PWD/$P";;
-  esac
-}
-
-make_all_absolute() {
-  local IN="$1" ARR P OUT=""
-  local SEP="$(path_list_separtor)"
-  IFS="$SEP" read -ra ARR <<<"$IN"
-  for P in "${ARR[@]}"; do
-    OUT="$OUT$(make_absolute "$P")$SEP"
-  done
-  echo "${OUT%$SEP}"
-}
-
-abs_dirname() {
-  local IN="$1"
-  echo "$(make_absolute "$(dirname "$IN")")"
-}
diff --git a/sdk/bazel_tools/ghc-lib/repositories.bzl b/sdk/bazel_tools/ghc-lib/repositories.bzl
deleted file mode 100644
index 4abb727a113a..000000000000
--- a/sdk/bazel_tools/ghc-lib/repositories.bzl
+++ /dev/null
@@ -1,185 +0,0 @@
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
-load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
-load("@bazel_tools//tools/build_defs/repo:utils.bzl", "patch", "workspace_and_buildfile")
-load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_package")
-load("@rules_sh//sh:sh.bzl", "sh_binaries")
-load("//bazel_tools/dev_env_tool:dev_env_tool.bzl", "dadew_binary_bundle")
-load("//nix:repositories.bzl", "common_nix_file_deps", "dev_env_nix_repos")
-load(
-    ":version.bzl",
-    "GHC_LIB_PATCHES",
-    "GHC_LIB_REPO_URL",
-    "GHC_LIB_REV",
-    "GHC_LIB_SHA256",
-    "GHC_PATCHES",
-    "GHC_REPO_URL",
-    "GHC_REV",
-)
-
-def _ghc_lib_deps_windows():
-    """Import dependencies of ghc-lib on Windows."""
-    dadew_binary_bundle(
-        name = "dadew_ghc_lib_deps_git",
-        paths = [
-            "bin/git",
-        ],
-        tool = "git",
-    )
-
-    dadew_binary_bundle(
-        name = "dadew_ghc_lib_deps_msys2",
-        paths = [
-            # msys2
-            "msys2",
-            "usr/bin/bash",
-            # autoconf
-            "usr/bin/autoconf",
-            "usr/bin/autoconf-2.71",
-            "usr/bin/autoheader",
-            "usr/bin/autoheader-2.71",
-            "usr/bin/autom4te",
-            "usr/bin/autom4te-2.71",
-            "usr/bin/autoreconf",
-            "usr/bin/autoreconf-2.71",
-            "usr/bin/autoscan",
-            "usr/bin/autoscan-2.71",
-            "usr/bin/autoupdate",
-            "usr/bin/autoupdate-2.71",
-            "usr/bin/ifnames",
-            "usr/bin/ifnames-2.71",
-            # automake
-            "usr/bin/aclocal",
-            "usr/bin/aclocal-1.16",
-            "usr/bin/automake",
-            "usr/bin/automake-1.16",
-            # diffutils
-            "usr/bin/cmp",
-            "usr/bin/diff",
-            "usr/bin/diff3",
-            "usr/bin/sdiff",
-            # gnumake
-            "usr/bin/make",
-            # m4
-            "usr/bin/m4",
-            # ncurses
-            "usr/bin/captoinfo",
-            "usr/bin/clear",
-            "usr/bin/infocmp",
-            "usr/bin/infotocap",
-            "usr/bin/reset",
-            "usr/bin/tabs",
-            "usr/bin/tic",
-            "usr/bin/tput",
-            "usr/bin/tset",
-            # perl
-            "usr/bin/perl",
-            # xz
-            "usr/bin/lzcat",
-            "usr/bin/lzcmp",
-            "usr/bin/lzdiff",
-            "usr/bin/lzegrep",
-            "usr/bin/lzfgrep",
-            "usr/bin/lzgrep",
-            "usr/bin/lzless",
-            "usr/bin/lzma",
-            "usr/bin/lzmadec",
-            "usr/bin/lzmainfo",
-            "usr/bin/lzmore",
-            "usr/bin/unlzma",
-            "usr/bin/unxz",
-            "usr/bin/xz",
-            "usr/bin/xzcat",
-            "usr/bin/xzcmp",
-            "usr/bin/xzdec",
-            "usr/bin/xzdiff",
-            "usr/bin/xzegrep",
-            "usr/bin/xzfgrep",
-            "usr/bin/xzgrep",
-            "usr/bin/xzless",
-            "usr/bin/xzmore",
-        ],
-        tool = "msys2",
-    )
-
-    dadew_binary_bundle(
-        name = "dadew_ghc_lib_deps_python",
-        paths = [
-            "python:python3",
-        ],
-        tool = "python-3.8.2",
-    )
-
-    http_archive(
-        name = "ghc_win",
-        build_file_content = """\
-load("@rules_sh//sh:sh.bzl", "sh_binaries")
-sh_binaries(
-    name = "tools",
-    srcs = glob(["ghc-9.0.2*/bin/*"]),
-    visibility = ["//visibility:public"],
-)
-""",
-        sha256 = "f6fbb8047ae16049dc6215a6abb652b4307205310bfffddea695a854af92dc99",
-        urls = ["https://downloads.haskell.org/~ghc/9.0.2/ghc-9.0.2-x86_64-unknown-mingw32.tar.xz"],
-    )
-
-    http_archive(
-        name = "cabal_win",
-        build_file_content = """\
-load("@rules_sh//sh:sh.bzl", "sh_binaries")
-sh_binaries(
-    name = "tools",
-    srcs = glob(["cabal.exe"]),
-    visibility = ["//visibility:public"],
-)
-""",
-        sha256 = "8222b49b6eac3d06aaa390bc688f467e8f949a38943567f46246f8320fd72ded",
-        urls = ["https://downloads.haskell.org/~cabal/cabal-install-3.6.0.0/cabal-install-3.6.0.0-x86_64-windows.zip"],
-    )
-
-def _ghc_lib_deps_unix():
-    """Import dependencies of ghc-lib on Linux and MacOS."""
-    nixpkgs_package(
-        name = "nix_ghc_lib_deps",
-        attribute_path = "ghc_lib_deps",
-        build_file = "@//bazel_tools/ghc-lib:BUILD.nix-deps",
-        fail_not_supported = False,
-        nix_file = "//nix:bazel.nix",
-        nix_file_deps = common_nix_file_deps,
-        repositories = dev_env_nix_repos,
-    )
-
-def ghc_lib_and_dependencies():
-    """Import ghc-lib and its Bazel dependencies.
-
-    Import the ghc-lib repository and the corresponding GHC repository as well
-    as any dependencies needed to generate the ghc-lib(-parser) Cabal sdists.
-
-    Note, this does not cover any Stackage dependencies, these are imported
-    using `stack_snapshot`. The final `ghc-lib(-parser)` Haskell packages are
-    also exposed via `@stackage` as vendored packages.
-    """
-    _ghc_lib_deps_unix()
-    _ghc_lib_deps_windows()
-    http_archive(
-        name = "ghc-lib-gen",
-        url = "{}/archive/{}.tar.gz".format(GHC_LIB_REPO_URL, GHC_LIB_REV),
-        sha256 = GHC_LIB_SHA256,
-        strip_prefix = "ghc-lib-{}".format(GHC_LIB_REV),
-        build_file = "@//bazel_tools/ghc-lib:BUILD.ghc-lib-gen",
-        patches = GHC_LIB_PATCHES,
-        patch_args = ["-p1"],
-    )
-    new_git_repository(
-        name = "da-ghc",
-        remote = GHC_REPO_URL,
-        commit = GHC_REV,
-        recursive_init_submodules = True,
-        build_file = "@//bazel_tools/ghc-lib:BUILD.ghc",
-        shallow_since = "1639050525 +0100",
-        patches = GHC_PATCHES,
-        patch_args = ["-p1"],
-    )
diff --git a/sdk/bazel_tools/haskell.bzl b/sdk/bazel_tools/haskell.bzl
index 8e5d2f7d98a9..9339c2c0b6ae 100644
--- a/sdk/bazel_tools/haskell.bzl
+++ b/sdk/bazel_tools/haskell.bzl
@@ -254,7 +254,7 @@ def da_haskell_repl(**kwargs):
         }),
         experimental_from_binary = [
             # Workaround for https://github.com/tweag/rules_haskell/issues/1726
-            "//bazel_tools/ghc-lib/...",
+            "//bazel/ghc-lib/...",
             "//nix/...",
         ],
         repl_ghci_args = [
diff --git a/sdk/bazel_tools/java.bzl b/sdk/bazel_tools/java.bzl
index 3343b23d5218..8ae8c7e2f646 100644
--- a/sdk/bazel_tools/java.bzl
+++ b/sdk/bazel_tools/java.bzl
@@ -3,8 +3,7 @@
 
 load("//bazel_tools:pom_file.bzl", "pom_file")
 load("@os_info//:os_info.bzl", "is_windows")
-load("@com_github_google_bazel_common//tools/javadoc:javadoc.bzl", "javadoc_library")
-load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_package")
+load("@google_bazel_common//tools/javadoc:javadoc.bzl", "javadoc_library")
 load("//bazel_tools:pkg.bzl", "pkg_empty_zip")
 load("//bazel_tools/dev_env_tool:dev_env_tool.bzl", "dadew_tool_home", "dadew_where")
 
diff --git a/sdk/bazel_tools/packaging/BUILD.bazel b/sdk/bazel_tools/packaging/BUILD.bazel
index dd9cc0a499f8..ac2b2488fb14 100644
--- a/sdk/bazel_tools/packaging/BUILD.bazel
+++ b/sdk/bazel_tools/packaging/BUILD.bazel
@@ -8,9 +8,9 @@ sh_binary(
     srcs = ["package-app.sh"],
     data = [
         "//bazel_tools/sh:mktgz",
-        "@gzip_dev_env//:gzip",
-        "@tar_dev_env//:tar",
-    ] + (["@patchelf_nix//:bin/patchelf"] if not is_windows else []),
+        # "@gzip_dev_env//:gzip",
+        "@tar.bzl//tar:tar",
+    ] + (["@patchelf//:patchelf"] if not is_windows else []),
     visibility = ["//visibility:public"],
     deps = ["@bazel_tools//tools/bash/runfiles"],
 )
@@ -20,8 +20,7 @@ sh_binary(
     srcs = ["package-oci-component.sh"],
     data = [
         "//bazel_tools/sh:mktgz",
-        "@gzip_dev_env//:gzip",
-        "@tar_dev_env//:tar",
+        "@bsd_tar_toolchains//:resolved_target_toolchain"
     ],
     visibility = ["//visibility:public"],
     deps = ["@bazel_tools//tools/bash/runfiles"],
diff --git a/sdk/bazel_tools/packaging/package-app.sh b/sdk/bazel_tools/packaging/package-app.sh
index 2faad6a967c0..199db271b905 100755
--- a/sdk/bazel_tools/packaging/package-app.sh
+++ b/sdk/bazel_tools/packaging/package-app.sh
@@ -49,13 +49,15 @@ fi
 case "$(uname -s)" in
   Darwin|Linux)
     tar=$(abspath $(rlocation tar_dev_env/tar))
-    gzip=$(abspath $(rlocation gzip_dev_env/gzip))
+# Unused
+#    gzip=$(abspath $(rlocation gzip_dev_env/gzip))
     mktgz=$(abspath $(rlocation com_github_digital_asset_daml/bazel_tools/sh/mktgz))
     patchelf=$(abspath $(rlocation patchelf_nix/bin/patchelf))
     ;;
   CYGWIN*|MINGW*|MSYS*)
     tar=$(abspath $(rlocation tar_dev_env/usr/bin/tar.exe))
-    gzip=$(abspath $(rlocation gzip_dev_env/usr/bin/gzip.exe))
+# Unused
+#    gzip=$(abspath $(rlocation gzip_dev_env/usr/bin/gzip.exe))
     mktgz=$(abspath $(rlocation com_github_digital_asset_daml/bazel_tools/sh/mktgz.exe))
     ;;
 esac
diff --git a/sdk/bazel_tools/packaging/package-oci-component.sh b/sdk/bazel_tools/packaging/package-oci-component.sh
index 522404bf8a7b..e32e1ed55767 100755
--- a/sdk/bazel_tools/packaging/package-oci-component.sh
+++ b/sdk/bazel_tools/packaging/package-oci-component.sh
@@ -31,16 +31,8 @@ if [[ -n ${RUNFILES_MANIFEST_FILE:-} ]]; then
   export RUNFILES_DIR=$(abspath $RUNFILES_MANIFEST_FILE)
 fi
 
-case "$(uname -s)" in
-  Darwin|Linux)
-    tar=$(abspath $(rlocation tar_dev_env/tar))
-    mktgz=$(abspath $(rlocation com_github_digital_asset_daml/bazel_tools/sh/mktgz))
-    ;;
-  CYGWIN*|MINGW*|MSYS*)
-    tar=$(abspath $(rlocation tar_dev_env/usr/bin/tar.exe))
-    mktgz=$(abspath $(rlocation com_github_digital_asset_daml/bazel_tools/sh/mktgz.exe))
-    ;;
-esac
+MKTGZ=$(abspath $(rlocation _main/bazel_tools/sh/mktgz))
+TAR=$(find "${RUNFILES_DIR}" -maxdepth 2 -name "tar")
 
 set -eou pipefail
 
@@ -75,7 +67,7 @@ for res in "$@"; do
       RAWNAME=${BASENAME%%.*}
       # unzip to a directory, as these often have internal relative symlinks to top level, which oras (used by DPM to download artifacts) can't handle right now
       mkdir -p "$WORKDIR/$RAWNAME"
-      $tar xf "$res" --strip-components=1 -C "$WORKDIR/$RAWNAME"
+      $TAR xf "$res" --strip-components=1 -C "$WORKDIR/$RAWNAME"
       ;;
     *)
       cp $res $WORKDIR
@@ -88,4 +80,4 @@ for dir in $(find $WORKDIR -type d -name '*.exe'); do
   mv $dir ${dir%.*}
 done
 
-cd $WORKDIR && $mktgz $OUT *
+cd $WORKDIR && $MKTGZ $OUT *
diff --git a/sdk/bazel_tools/proto.bzl b/sdk/bazel_tools/proto.bzl
index 8e1d33895d03..d9cd8599f891 100644
--- a/sdk/bazel_tools/proto.bzl
+++ b/sdk/bazel_tools/proto.bzl
@@ -6,7 +6,7 @@ load("//bazel_tools:javadoc_library.bzl", "javadoc_library")
 load("//bazel_tools:pkg.bzl", "pkg_empty_zip")
 load("//bazel_tools:pom_file.bzl", "pom_file")
 load("//bazel_tools:scala.bzl", "scala_source_jar", "scaladoc_jar")
-load("@io_bazel_rules_scala//scala:scala.bzl", "scala_library")
+load("@rules_scala//scala:scala.bzl", "scala_library")
 load("@os_info//:os_info.bzl", "is_windows")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
 load("@rules_proto//proto:defs.bzl", "proto_library")
@@ -140,7 +140,7 @@ proto_gen = rule(
             allow_files = True,
         ),
         "protoc": attr.label(
-            default = Label("@com_google_protobuf//:protoc"),
+            default = Label("@protobuf//:protoc"),
             cfg = "host",
             allow_files = True,
             executable = True,
diff --git a/sdk/bazel_tools/scala.bzl b/sdk/bazel_tools/scala.bzl
index 69c1704873f2..02fef320fae2 100644
--- a/sdk/bazel_tools/scala.bzl
+++ b/sdk/bazel_tools/scala.bzl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 load(
-    "@io_bazel_rules_scala//scala:scala.bzl",
+    "@rules_scala//scala:scala.bzl",
     "scala_binary",
     "scala_library",
     "scala_library_suite",
@@ -12,9 +12,9 @@ load(
     "scala_test_suite",
 )
 load("@rules_java//java:defs.bzl", "JavaInfo")
-load("@io_bazel_rules_scala//scala/private:common.bzl", "sanitize_string_for_usage")
+load("@rules_scala//scala/private:common.bzl", "sanitize_string_for_usage")
 load(
-    "@io_bazel_rules_scala//jmh:jmh.bzl",
+    "@rules_scala//jmh:jmh.bzl",
     "scala_benchmark_jmh",
 )
 load("//bazel_tools:pom_file.bzl", "pom_file")
diff --git a/sdk/bazel_tools/scala/BUILD.bazel b/sdk/bazel_tools/scala/BUILD.bazel
index f6fa4ffb56a8..3a47c704079f 100644
--- a/sdk/bazel_tools/scala/BUILD.bazel
+++ b/sdk/bazel_tools/scala/BUILD.bazel
@@ -1,7 +1,7 @@
 # Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-load("@io_bazel_rules_scala//scala:scala_toolchain.bzl", "scala_toolchain")
+load("@rules_scala//scala:scala_toolchain.bzl", "scala_toolchain")
 
 scala_toolchain(
     name = "toolchain_impl",
@@ -12,6 +12,6 @@ scala_toolchain(
 toolchain(
     name = "toolchain",
     toolchain = "toolchain_impl",
-    toolchain_type = "@io_bazel_rules_scala//scala:toolchain_type",
+    toolchain_type = "@rules_scala//scala:toolchain_type",
     visibility = ["//visibility:public"],
 )
diff --git a/sdk/bazel_tools/sh/BUILD.bazel b/sdk/bazel_tools/sh/BUILD.bazel
index 00a4f1a8196c..d02522f9ee0c 100644
--- a/sdk/bazel_tools/sh/BUILD.bazel
+++ b/sdk/bazel_tools/sh/BUILD.bazel
@@ -9,7 +9,7 @@ exports_files([
 sh_binary(
     name = "mktar",
     srcs = ["mktar.sh"],
-    data = ["@tar_dev_env//:tar"],
+    data = ["@tar.bzl//tar:tar"],
     visibility = ["//visibility:public"],
     deps = ["@bazel_tools//tools/bash/runfiles"],
 )
@@ -18,8 +18,8 @@ sh_binary(
     name = "mktgz",
     srcs = ["mktgz.sh"],
     data = [
-        "@gzip_dev_env//:gzip",
-        "@tar_dev_env//:tar",
+        "@pigz//:pigz",
+        "@bsd_tar_toolchains//:resolved_target_toolchain"
     ],
     visibility = ["//visibility:public"],
     deps = ["@bazel_tools//tools/bash/runfiles"],
diff --git a/sdk/bazel_tools/sh/mktgz.sh b/sdk/bazel_tools/sh/mktgz.sh
index 35d9357b15fc..04a17b1e5e39 100755
--- a/sdk/bazel_tools/sh/mktgz.sh
+++ b/sdk/bazel_tools/sh/mktgz.sh
@@ -24,24 +24,16 @@ EOF
 }
 trap usage ERR
 
-case "$(uname -s)" in
-  Darwin|Linux)
-    tar=$(rlocation tar_dev_env/tar)
-    gzip=$(rlocation gzip_dev_env/gzip)
-    ;;
-  CYGWIN*|MINGW*|MSYS*)
-    tar=$(rlocation tar_dev_env/usr/bin/tar.exe)
-    gzip=$(rlocation gzip_dev_env/usr/bin/gzip.exe)
-    ;;
-esac
+PIGZ="$(rlocation "pigz~/pigz")"
+TAR=$(find "${RUNFILES_DIR}" -maxdepth 2 -name "tar")
 
-$tar c "${@:2}" \
-  --owner="0" \
-  --group="0" \
+$TAR \
+  --owner=0 \
+  --group=0 \
   --numeric-owner \
   --mtime="2000-01-01 00:00Z" \
   --no-acls \
   --no-xattrs \
-  --no-selinux \
-  --sort="name" \
-  | $gzip -n > "$1"
+  --use-compress-program "$PIGZ -n" \
+  -cf ${1} \
+  "${@:2}"
diff --git a/sdk/canton/BUILD.bazel b/sdk/canton/BUILD.bazel
index ed304807dd60..cf485f9e4777 100644
--- a/sdk/canton/BUILD.bazel
+++ b/sdk/canton/BUILD.bazel
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
-load("@io_bazel_rules_scala//scala:scala.bzl", "scala_binary")
+load("@rules_scala//scala:scala.bzl", "scala_binary")
 load("//bazel_tools:proto.bzl", "proto_gen", "proto_jars")
 load("//bazel_tools/packaging:packaging.bzl", "package_oci_component")
 load("//canton:canton_version.bzl", "CANTON_OPEN_SOURCE_SHA", "CANTON_OPEN_SOURCE_TAG")
diff --git a/sdk/canton/community/daml-lf/interpreter/BUILD.bazel b/sdk/canton/community/daml-lf/interpreter/BUILD.bazel
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/compatibility/deps.bzl b/sdk/compatibility/deps.bzl
index 1d902bd6f269..13a3bd68a8fd 100644
--- a/sdk/compatibility/deps.bzl
+++ b/sdk/compatibility/deps.bzl
@@ -32,8 +32,6 @@ load(
     "@daml//:deps.bzl",
     "bazel_gazelle_sha256",
     "bazel_gazelle_version",
-    "buildifier_sha256",
-    "buildifier_version",
     "rules_bazel_common_sha256",
     "rules_bazel_common_version",
     "rules_go_sha256",
@@ -115,14 +113,6 @@ def daml_deps():
                 sha256 = rules_nixpkgs_sha256,
             )
 
-    if "com_github_bazelbuild_buildtools" not in native.existing_rules():
-        http_archive(
-            name = "com_github_bazelbuild_buildtools",
-            sha256 = buildifier_sha256,
-            strip_prefix = "buildtools-{}".format(buildifier_version),
-            url = "https://github.com/bazelbuild/buildtools/archive/{}.tar.gz".format(buildifier_version),
-        )
-
     if "com_github_madler_zlib" not in native.existing_rules():
         http_archive(
             name = "com_github_madler_zlib",
diff --git a/sdk/compiler/damlc/tests/BUILD.bazel b/sdk/compiler/damlc/tests/BUILD.bazel
index 195bee731a66..297c62ddfd8e 100644
--- a/sdk/compiler/damlc/tests/BUILD.bazel
+++ b/sdk/compiler/damlc/tests/BUILD.bazel
@@ -912,7 +912,7 @@ sh_test(
     srcs = ["src/daml-ghc-deterministic.sh"],
     args = [
         "$(location //compiler/damlc)",
-        "$(location @com_google_protobuf//:protoc)",
+        "$(location @protobuf//:protoc)",
         "$(POSIX_DIFF)",
         "$(location //daml-script/daml:daml-script.dar)",
         sdk_version,
@@ -923,7 +923,7 @@ sh_test(
         "//compiler/damlc",
         "//compiler/damlc/pkg-db",
         "//daml-script/daml:daml-script.dar",
-        "@com_google_protobuf//:protoc",
+        "@protobuf//:protoc",
     ],
     toolchains = [
         "@rules_sh//sh/posix:make_variables",
diff --git a/sdk/compiler/lsp-tests/BUILD.bazel b/sdk/compiler/lsp-tests/BUILD.bazel
index 76841f324622..de9789f98101 100644
--- a/sdk/compiler/lsp-tests/BUILD.bazel
+++ b/sdk/compiler/lsp-tests/BUILD.bazel
@@ -46,7 +46,7 @@ da_haskell_test(
         "//libs-haskell/bazel-runfiles",
         "//libs-haskell/test-utils",
         "//sdk-version/hs:sdk-version-lib",
-        "@ghcide_ghc_lib//:testing",
+        "@ghcide_lib//:testing",
     ],
 )
 
diff --git a/sdk/deps.bzl b/sdk/deps.bzl
index 8836505d322a..de71d329cf2b 100644
--- a/sdk/deps.bzl
+++ b/sdk/deps.bzl
@@ -61,9 +61,6 @@ rules_nixpkgs_toolchain_patches = {
     "posix": [],
 }
 
-buildifier_version = "b163fcf72b7def638f364ed129c9b28032c1d39b"
-buildifier_sha256 = "c2399161fa569f7c815f8e27634035557a2e07a557996df579412ac73bf52c23"
-
 zlib_version = "1.2.11"
 zlib_sha256 = "629380c90a77b964d896ed37163f5c3a34f6e6d897311f1df2a7016355c45eff"
 rules_nodejs_version = "5.8.5"
@@ -345,16 +342,6 @@ def daml_deps():
             patch_args = ["-p1"],
         )
 
-    # Buildifier.
-    # It is written in Go and hence needs rules_go to be available.
-    if "com_github_bazelbuild_buildtools" not in native.existing_rules():
-        http_archive(
-            name = "com_github_bazelbuild_buildtools",
-            sha256 = buildifier_sha256,
-            strip_prefix = "buildtools-{}".format(buildifier_version),
-            url = "https://github.com/bazelbuild/buildtools/archive/{}.tar.gz".format(buildifier_version),
-        )
-
     native.bind(
         name = "guava",
         actual = "@com_google_guava_guava//jar",
diff --git a/sdk/docs/BUILD.bazel b/sdk/docs/BUILD.bazel
index 00bb3222c4f0..75bfcea8e183 100644
--- a/sdk/docs/BUILD.bazel
+++ b/sdk/docs/BUILD.bazel
@@ -1,7 +1,7 @@
 # Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-load("@build_bazel_rules_nodejs//:index.bzl", "nodejs_binary")
+# load("@build_bazel_rules_nodejs//:index.bzl", "nodejs_binary")
 load("@os_info//:os_info.bzl", "is_windows")
 load("//rules_daml:daml.bzl", "daml_build_test", "daml_compile", "daml_multi_package_test", "daml_test")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
diff --git a/sdk/go_deps.bzl b/sdk/go_deps.bzl
index f6ddb972d47a..47ec09f0a360 100644
--- a/sdk/go_deps.bzl
+++ b/sdk/go_deps.bzl
@@ -1,7 +1,7 @@
 # Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-load("@bazel_gazelle//:deps.bzl", "go_repository")
+load("@gazelle//:deps.bzl", "go_repository")
 
 def go_deps():
     go_repository(
diff --git a/sdk/language-support/js/daml-types/BUILD.bazel b/sdk/language-support/js/daml-types/BUILD.bazel
index ec32adfe83b8..3886a6cbdf9f 100644
--- a/sdk/language-support/js/daml-types/BUILD.bazel
+++ b/sdk/language-support/js/daml-types/BUILD.bazel
@@ -1,71 +1,71 @@
-# Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
-load("@rules_pkg//:pkg.bzl", "pkg_tar")
-load("@build_bazel_rules_nodejs//:index.bzl", "pkg_npm")
-load("@language_support_js_deps//eslint:index.bzl", "eslint_test")
-load("@os_info//:os_info.bzl", "is_windows")
-load("//language-support/js:defs.bzl", "da_ts_library")
-load("//language-support/js:eslint.bzl", "eslint_test")
-load("//language-support/js:jest.bzl", "jest_test")
-load("//language-support/js:typedoc.bzl", "ts_docs")
-load("@build_environment//:configuration.bzl", "sdk_version")
-
-sources = [
-    "index.ts",
-    "index.test.ts",
-]
-
-da_ts_library(
-    name = "daml-types",
-    srcs = sources,
-    module_name = "@daml/types",
-    tsconfig = ":tsconfig.json",
-    visibility = ["//visibility:public"],
-    deps = [
-        "@language_support_js_deps//@mojotech/json-type-validation",
-        "@language_support_js_deps//@types/jest",
-        "@language_support_js_deps//@types/lodash",
-    ],
-) if not is_windows else None
-
-genrule(
-    name = "license",
-    srcs = ["//:LICENSE"],
-    outs = ["LICENSE"],
-    cmd = """
-      cp $(location //:LICENSE) $@
-    """,
-)
-
-eslint_test(
-    name = "lint",
-    srcs = sources,
-    data = ["tsconfig.json"],
-    tsconfig = "tsconfig.eslint.json",
-)
-
-pkg_npm(
-    name = "npm_package",
-    package_name = "@daml/types",
-    srcs = [
-        ":README.md",
-        ":package.json",
-        ":tsconfig.json",
-    ],
-    substitutions = {"0.0.0-SDKVERSION": sdk_version},
-    visibility = ["//visibility:public"],
-    deps = [
-        ":daml-types",
-        ":license",
-    ],
-) if not is_windows else None
-
-jest_test(
-    name = "test",
-    srcs = sources,
-    deps = [
-        "@language_support_js_deps//@mojotech/json-type-validation",
-        "@language_support_js_deps//@types/lodash",
-    ],
-)
+# # Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+# # SPDX-License-Identifier: Apache-2.0
+#
+# load("@rules_pkg//:pkg.bzl", "pkg_tar")
+# load("@build_bazel_rules_nodejs//:index.bzl", "pkg_npm")
+# load("@language_support_js_deps//eslint:index.bzl", "eslint_test")
+# load("@os_info//:os_info.bzl", "is_windows")
+# load("//language-support/js:defs.bzl", "da_ts_library")
+# load("//language-support/js:eslint.bzl", "eslint_test")
+# load("//language-support/js:jest.bzl", "jest_test")
+# load("//language-support/js:typedoc.bzl", "ts_docs")
+# load("@build_environment//:configuration.bzl", "sdk_version")
+#
+# sources = [
+#     "index.ts",
+#     "index.test.ts",
+# ]
+#
+# da_ts_library(
+#     name = "daml-types",
+#     srcs = sources,
+#     module_name = "@daml/types",
+#     tsconfig = ":tsconfig.json",
+#     visibility = ["//visibility:public"],
+#     deps = [
+#         "@language_support_js_deps//@mojotech/json-type-validation",
+#         "@language_support_js_deps//@types/jest",
+#         "@language_support_js_deps//@types/lodash",
+#     ],
+# ) if not is_windows else None
+#
+# genrule(
+#     name = "license",
+#     srcs = ["//:LICENSE"],
+#     outs = ["LICENSE"],
+#     cmd = """
+#       cp $(location //:LICENSE) $@
+#     """,
+# )
+#
+# eslint_test(
+#     name = "lint",
+#     srcs = sources,
+#     data = ["tsconfig.json"],
+#     tsconfig = "tsconfig.eslint.json",
+# )
+#
+# pkg_npm(
+#     name = "npm_package",
+#     package_name = "@daml/types",
+#     srcs = [
+#         ":README.md",
+#         ":package.json",
+#         ":tsconfig.json",
+#     ],
+#     substitutions = {"0.0.0-SDKVERSION": sdk_version},
+#     visibility = ["//visibility:public"],
+#     deps = [
+#         ":daml-types",
+#         ":license",
+#     ],
+# ) if not is_windows else None
+#
+# jest_test(
+#     name = "test",
+#     srcs = sources,
+#     deps = [
+#         "@language_support_js_deps//@mojotech/json-type-validation",
+#         "@language_support_js_deps//@types/lodash",
+#     ],
+# )
diff --git a/sdk/libs-haskell/ledger-api-pb/BUILD.bazel b/sdk/libs-haskell/ledger-api-pb/BUILD.bazel
index ffcf3619e0c1..9ecc48a90b2a 100644
--- a/sdk/libs-haskell/ledger-api-pb/BUILD.bazel
+++ b/sdk/libs-haskell/ledger-api-pb/BUILD.bazel
@@ -3,11 +3,9 @@
 
 load("//bazel_tools:haskell.bzl", "da_haskell_library")
 
-google_protobuf_src = "external/com_google_protobuf/src"
-
 genrule(
     name = "google-protobuf-pb-sources",
-    srcs = ["@com_google_protobuf//:well_known_type_protos"],
+    srcs = ["@protobuf//:well_known_type_protos"],
     outs = ["Google/Protobuf/" + b for b in [
         "Any.hs",
         "Duration.hs",
@@ -17,18 +15,19 @@ genrule(
         "FieldMask.hs",
     ]],
     cmd = """
-        for src in \
-            external/com_google_protobuf/src/google/protobuf/any.proto \
-            external/com_google_protobuf/src/google/protobuf/duration.proto \
-            external/com_google_protobuf/src/google/protobuf/empty.proto \
-            external/com_google_protobuf/src/google/protobuf/wrappers.proto \
-            external/com_google_protobuf/src/google/protobuf/struct.proto \
-            external/com_google_protobuf/src/google/protobuf/field_mask.proto \
-        ; do
-            $(location @proto3-suite//:compile-proto-file) \
-                --includeDir """ + google_protobuf_src + """ \
-                --proto google/protobuf/$$(basename $$src) \
-                --out $(@D)
+        for f in $(locations @protobuf//:well_known_type_protos); do
+            PROTOBUF_INCLUDE=$${f%%/google/protobuf/*}
+            break
+        done
+        for src in $(locations @protobuf//:well_known_type_protos); do
+            case $$(basename $$src) in
+                any.proto|duration.proto|empty.proto|wrappers.proto|struct.proto|field_mask.proto)
+                    $(location @proto3-suite//:compile-proto-file) \
+                        --includeDir "$$PROTOBUF_INCLUDE" \
+                        --proto google/protobuf/$$(basename $$src) \
+                        --out $(@D)
+                    ;;
+            esac
         done
     """,
     tools = [
@@ -37,8 +36,6 @@ genrule(
     visibility = ["//visibility:public"],
 )
 
-google_rpc_src = "external/go_googleapis"
-
 filegroup(
     name = "google-rpc-source-protos",
     srcs = [
@@ -51,17 +48,23 @@ genrule(
     name = "google-rpc-pb-sources",
     srcs = [
         ":google-rpc-source-protos",
-        "@com_google_protobuf//:well_known_type_protos",
+        "@protobuf//:well_known_type_protos",
     ],
     outs = [
         "Google/Rpc/Status.hs",
         "Google/Rpc/ErrorDetails.hs",
     ],
     cmd = """
+        for f in $(locations @protobuf//:well_known_type_protos); do
+            PROTOBUF_INCLUDE=$${f%%/google/protobuf/*}
+            break
+        done
+        FIRST_RPC=$$(echo $(locations :google-rpc-source-protos) | cut -d' ' -f1)
+        RPC_INCLUDE=$${FIRST_RPC%%/google/rpc/*}
         for src in $(locations :google-rpc-source-protos); do
             $(location @proto3-suite//:compile-proto-file) \
-                --includeDir """ + google_protobuf_src + """ \
-                --includeDir """ + google_rpc_src + """ \
+                --includeDir "$$PROTOBUF_INCLUDE" \
+                --includeDir "$$RPC_INCLUDE" \
                 --proto google/rpc/$$(basename $$src) \
                 --out $(@D)
         done
@@ -80,7 +83,7 @@ filegroup(
 genrule(
     name = "ledger-api-pb-sources",
     srcs = [
-        "@com_google_protobuf//:well_known_type_protos",
+        "@protobuf//:well_known_type_protos",
         "@go_googleapis//google/rpc:status.proto",
         "ledger-api-protos-fg",
     ],
@@ -93,10 +96,16 @@ genrule(
         "Com/Daml/Ledger/Api/V2/Admin/UserManagementService.hs",
     ],
     cmd = """
+        for f in $(locations @protobuf//:well_known_type_protos); do
+            PROTOBUF_INCLUDE=$${f%%/google/protobuf/*}
+            break
+        done
+        RPC_STATUS="$(location @go_googleapis//google/rpc:status.proto)"
+        RPC_INCLUDE=$${RPC_STATUS%%/google/rpc/*}
         for src in $(locations :ledger-api-protos-fg); do
             $(location @proto3-suite//:compile-proto-file) \
-                --includeDir """ + google_protobuf_src + """ \
-                --includeDir """ + google_rpc_src + """ \
+                --includeDir "$$PROTOBUF_INCLUDE" \
+                --includeDir "$$RPC_INCLUDE" \
                 --includeDir libs-haskell/ledger-api-pb/src/protobuf \
                 --proto $${src#libs-haskell/ledger-api-pb/src/protobuf/} \
                 --out $(@D)
diff --git a/sdk/replacements/BUILD.bazel b/sdk/replacements/BUILD.bazel
index 7d699a495fcf..d32752a5db99 100644
--- a/sdk/replacements/BUILD.bazel
+++ b/sdk/replacements/BUILD.bazel
@@ -4,4 +4,4 @@
 # This file defines custom targets that are referenced in replacements in
 # dependencies.yaml.
 
-load("@io_bazel_rules_scala//scala:scala_import.bzl", "scala_import")
+load("@rules_scala//scala:scala_import.bzl", "scala_import")
diff --git a/sdk/scala-protoc-plugins/scalapb/BUILD.bazel b/sdk/scala-protoc-plugins/scalapb/BUILD.bazel
index 1863ab3935de..412a1a423bbb 100644
--- a/sdk/scala-protoc-plugins/scalapb/BUILD.bazel
+++ b/sdk/scala-protoc-plugins/scalapb/BUILD.bazel
@@ -39,7 +39,7 @@ da_scala_binary(
 # protoc_gen_scala_deploy.jar'.  Either figure out how to do this in java
 # directly or write the wrapper in C++ ot remove the go dependency here.
 #
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
     name = "go_default_library",
diff --git a/sdk/stack-snapshot.yaml b/sdk/stackage_snapshot.yaml
similarity index 97%
rename from sdk/stack-snapshot.yaml
rename to sdk/stackage_snapshot.yaml
index bdd2e9a549a3..ca034c46f2bc 100644
--- a/sdk/stack-snapshot.yaml
+++ b/sdk/stackage_snapshot.yaml
@@ -3,6 +3,7 @@
 
 resolver: lts-19.33
 packages:
+  - lsp-types-1.4.0.0
   - ghc-lib-parser-ex-8.8.5.8
   - github: digital-asset/hlint
     commit: "99999eee1c220396e1545788ef22ca3c204908a9"