diff --git a/.bazelrc b/.bazelrc
index 04e1a7111..bb12497c4 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -70,6 +70,8 @@ build:windows --extra_execution_platforms=//bazel/platforms:x64_windows-clang-cl
 build:windows --features=static_link_msvcrt
 build:windows --cxxopt=/std:c++17
 build:windows --host_cxxopt=/std:c++17
+# TODO: Remove once https://github.com/bazelbuild/rules_kotlin/issues/1309 is addressed.
+build:windows --legacy_external_runfiles
 # Required as PATH doubles as the shared library search path on Windows and the
 # Java agent functionality depends on system-provided shared libraries.
 test:windows --noincompatible_strict_action_env
diff --git a/.bazelversion b/.bazelversion
index e81e85b81..e7fdef7e2 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-7.6.2
+8.4.2
diff --git a/MODULE.bazel b/MODULE.bazel
index 6fd61dd59..fc9dbba6f 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -27,6 +27,7 @@ bazel_dep(name = "rules_jvm_external", version = "6.8")
 bazel_dep(name = "rules_kotlin", version = "2.1.9")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_pkg", version = "1.1.0")
+bazel_dep(name = "rules_cc", version = "0.2.12")
 bazel_dep(name = "toolchains_llvm", version = "1.5.0")
 
 ################################################################################
@@ -432,7 +433,7 @@ llvm.sysroot(
 use_repo(llvm, "llvm_toolchain")
 
 # Required by the reference to the Windows toolchain in @local_config_cc from .bazelrc.
-cc_configure = use_extension("@bazel_tools//tools/cpp:cc_configure.bzl", "cc_configure_extension")
+cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
 use_repo(cc_configure, "local_config_cc")
 
 # Referenced in BUILD files.
diff --git a/deploy/BUILD.bazel b/deploy/BUILD.bazel
index e779478b4..362b6d08c 100644
--- a/deploy/BUILD.bazel
+++ b/deploy/BUILD.bazel
@@ -144,11 +144,11 @@ sh_test(
         srcs = [artifact + "_artifact_test.sh"],
         args = [
             "$(rootpath :%s)" % artifact,
-            "$(JAVABASE)",
+            "$(location @bazel_tools//tools/zip:zipper)",
         ],
         data = [
             ":" + artifact,
-            "@bazel_tools//tools/jdk:current_java_runtime",
+            "@bazel_tools//tools/zip:zipper",
         ],
         tags = [
             # Coverage instrumentation necessarily adds files to the jar that we
@@ -156,9 +156,6 @@ sh_test(
             "no-coverage",
         ],
         target_compatible_with = SKIP_ON_WINDOWS,
-        toolchains = [
-            "@bazel_tools//tools/jdk:current_java_runtime",
-        ],
     )
     for artifact in [
         "jazzer-api",
diff --git a/deploy/jazzer-api_artifact_test.sh b/deploy/jazzer-api_artifact_test.sh
index d1a60e608..e53a3193f 100755
--- a/deploy/jazzer-api_artifact_test.sh
+++ b/deploy/jazzer-api_artifact_test.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 #
 # Copyright 2024 Code Intelligence GmbH
 #
@@ -16,12 +16,13 @@
 #
 
 [ -f "$1" ] || exit 1
-JAR="$2/bin/jar"
-[ -e "$JAR" ] || exit 1
+ZIPPER="$2"
+[[ -x "$ZIPPER" ]] || exit 1
+
 # List all files in the jar and exclude an allowed list of files.
 # Since grep fails if there is no match, ! ... | grep ... fails if there is a
 # match.
-! "$JAR" tf "$1" | \
+! "$ZIPPER" v "$1" | awk '{print $3}' | \
   grep -v \
     -e '^com/$' \
     -e '^com/code_intelligence/$' \
diff --git a/deploy/jazzer-junit_artifact_test.sh b/deploy/jazzer-junit_artifact_test.sh
index 3ce0c8fcf..4343f142b 100755
--- a/deploy/jazzer-junit_artifact_test.sh
+++ b/deploy/jazzer-junit_artifact_test.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 #
 # Copyright 2024 Code Intelligence GmbH
 #
@@ -16,12 +16,13 @@
 #
 
 [ -f "$1" ] || exit 1
-JAR="$2/bin/jar"
-[ -e "$JAR" ] || exit 1
+ZIPPER="$2"
+[[ -x "$ZIPPER" ]] || exit 1
+
 # List all files in the jar and exclude an allowed list of files.
 # Since grep fails if there is no match, ! ... | grep ... fails if there is a
 # match.
-! "$JAR" tf "$1" | \
+! "$ZIPPER" v "$1" | awk '{print $3}' | \
   grep -v \
     -e '^com/$' \
     -e '^com/code_intelligence/$' \
diff --git a/deploy/jazzer_artifact_test.sh b/deploy/jazzer_artifact_test.sh
index 55cbd6a7f..03bd09038 100755
--- a/deploy/jazzer_artifact_test.sh
+++ b/deploy/jazzer_artifact_test.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 #
 # Copyright 2024 Code Intelligence GmbH
 #
@@ -16,12 +16,13 @@
 #
 
 [ -f "$1" ] || exit 1
-JAR="$2/bin/jar"
-[ -e "$JAR" ] || exit 1
+ZIPPER="$2"
+[[ -x "$ZIPPER" ]] || exit 1
+
 # List all files in the jar and exclude an allowed list of files.
 # Since grep fails if there is no match, ! ... | grep ... fails if there is a
 # match.
-! "$JAR" tf "$1" | \
+! "$ZIPPER" v "$1" | awk '{print $3}' | \
   grep -v \
     -e '^com/$' \
     -e '^com/code_intelligence/$' \
diff --git a/src/main/java/com/code_intelligence/jazzer/runtime/BUILD.bazel b/src/main/java/com/code_intelligence/jazzer/runtime/BUILD.bazel
index 69adaf6b7..9532a0e95 100644
--- a/src/main/java/com/code_intelligence/jazzer/runtime/BUILD.bazel
+++ b/src/main/java/com/code_intelligence/jazzer/runtime/BUILD.bazel
@@ -65,11 +65,11 @@ sh_test(
     srcs = ["verify_shading.sh"],
     args = [
         "$(rootpath jazzer_bootstrap.jar)",
-        "$(JAVABASE)",
+        "$(location @bazel_tools//tools/zip:zipper)",
     ],
     data = [
         "jazzer_bootstrap.jar",
-        "@bazel_tools//tools/jdk:current_java_runtime",
+        "@bazel_tools//tools/zip:zipper",
     ],
     tags = [
         # Coverage instrumentation necessarily adds files to the jar that we
@@ -77,9 +77,6 @@ sh_test(
         "no-coverage",
     ],
     target_compatible_with = SKIP_ON_WINDOWS,
-    toolchains = [
-        "@bazel_tools//tools/jdk:current_java_runtime",
-    ],
 )
 
 # At runtime, the AgentInstaller appends jazzer_bootstrap.jar to the bootstrap
diff --git a/src/main/java/com/code_intelligence/jazzer/runtime/verify_shading.sh b/src/main/java/com/code_intelligence/jazzer/runtime/verify_shading.sh
index 7bdc10716..fef9b29e7 100755
--- a/src/main/java/com/code_intelligence/jazzer/runtime/verify_shading.sh
+++ b/src/main/java/com/code_intelligence/jazzer/runtime/verify_shading.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 #
 # Copyright 2024 Code Intelligence GmbH
 #
@@ -16,12 +16,13 @@
 #
 
 [ -f "$1" ] || exit 1
-JAR="$2/bin/jar"
-[ -e "$JAR" ] || exit 1
+ZIPPER="$2"
+[[ -x "$ZIPPER" ]] || exit 1
+
 # List all files in the jar and exclude an allowed list of files.
 # Since grep fails if there is no match, ! ... | grep ... fails if there is a
 # match.
-! "$JAR" tf "$1" | \
+! "$ZIPPER" v "$1" | awk '{print $3}' | \
   grep -v \
     -e '^com/$' \
     -e '^com/code_intelligence/$' \