diff --git a/.bazelrc b/.bazelrc
index a3f257af58dc8..dcfff1576c319 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -20,12 +20,16 @@ build --enable_runfiles
 build --flag_alias=pin_browsers=//common:pin_browsers
 build --flag_alias=headless=//common:headless
 
-# Set the default java toolchain
+# Set the default java toolchain.
+# When bumping these, also update java_runtime in //common/remote-build/java to match.
 build --java_language_version=25
 build --java_runtime_version=remotejdk_25
 build --tool_java_language_version=25
 build --tool_java_runtime_version=remotejdk_25
 
+# Silence protobuf sun.misc.Unsafe warnings from the JDK 25 Java compile workers.
+build --extra_toolchains=//common/remote-build/java:java-toolchain_definition
+
 # We target java 11 by default
 build --javacopt="--release 11"
 
diff --git a/common/remote-build/java/BUILD.bazel b/common/remote-build/java/BUILD.bazel
new file mode 100644
index 0000000000000..cc6d59e2aabda
--- /dev/null
+++ b/common/remote-build/java/BUILD.bazel
@@ -0,0 +1,23 @@
+load("@rules_java//toolchains:default_java_toolchain.bzl", "DEFAULT_TOOLCHAIN_CONFIGURATION", "default_java_toolchain")
+
+package(default_visibility = ["//visibility:public"])
+
+# Quiet protobuf's sun.misc.Unsafe warnings spammed by the JDK 25 compile workers.
+_SILENCE_UNSAFE_WARNING = ["--sun-misc-unsafe-memory-access=allow"]
+
+default_java_toolchain(
+    name = "java-toolchain",
+    configuration = DEFAULT_TOOLCHAIN_CONFIGURATION | {
+        "java_runtime": "@rules_java//toolchains:remotejdk_25",
+        "jvm_opts": DEFAULT_TOOLCHAIN_CONFIGURATION["jvm_opts"] + _SILENCE_UNSAFE_WARNING,
+        "turbine_jvm_opts": DEFAULT_TOOLCHAIN_CONFIGURATION["turbine_jvm_opts"] + _SILENCE_UNSAFE_WARNING,
+    },
+    toolchain_definition = False,
+)
+
+# No version target_setting, so it applies regardless of --java_language_version.
+toolchain(
+    name = "java-toolchain_definition",
+    toolchain = ":java-toolchain",
+    toolchain_type = "@bazel_tools//tools/jdk:toolchain_type",
+)