diff --git a/.bazelrc b/.bazelrc
new file mode 100644
index 000000000..d2ef107a5
--- /dev/null
+++ b/.bazelrc
@@ -0,0 +1,10 @@
+# Enable bzlmod for modern dependency management with MODULE.bazel
+common --enable_bzlmod
+
+# Java runtime configuration for bzlmod
+# Use remote JDK to avoid dependency on local Java installation
+build --java_runtime_version=remotejdk_11
+build --tool_java_runtime_version=remotejdk_11
+
+# Build settings
+build --incompatible_strict_action_env
diff --git a/.bazelversion b/.bazelversion
new file mode 100644
index 000000000..e81e85b81
--- /dev/null
+++ b/.bazelversion
@@ -0,0 +1 @@
+7.6.2
diff --git a/.circleci/config.yml b/.circleci/config.yml
index fea7fb056..417aefaaa 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,6 +1,6 @@
 references:
   envoy-build-image: &envoy-build-image
-    envoyproxy/envoy-build:220e5cb537b5185c953de1aac7d0613f8cf155ac
+    envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8
 
 version: 2
 jobs:
diff --git a/ci/build_setup.sh b/ci/build_setup.sh
index 061422c07..82280f844 100755
--- a/ci/build_setup.sh
+++ b/ci/build_setup.sh
@@ -25,7 +25,8 @@ export TEST_TMPDIR=/build/tmp
 export BAZEL="bazel"
 
 # Not sandboxing, since non-privileged Docker can't do nested namespaces.
-BAZEL_OPTIONS="--package_path %workspace%:/source"
+# Note: --package_path is removed as it's incompatible with bzlmod (MODULE.bazel)
+BAZEL_OPTIONS=""
 export BAZEL_QUERY_OPTIONS="${BAZEL_OPTIONS}"
 export BAZEL_BUILD_OPTIONS="--strategy=Genrule=standalone --spawn_strategy=standalone \
   --verbose_failures ${BAZEL_OPTIONS} --jobs=${NUM_CPUS} \