diff --git a/setup_extra.bzl b/setup_extra.bzl
index fcfc137..ea5e544 100644
--- a/setup_extra.bzl
+++ b/setup_extra.bzl
@@ -1,7 +1,6 @@
 load("@envoy//bazel:python_dependencies.bzl", "envoy_python_dependencies")
 load("@envoy//bazel:repo.bzl", "envoy_repo")
 load("@envoy_toolshed//:packages.bzl", "load_website_packages")
-load("@python3_12//:defs.bzl", "interpreter")
 load("@rules_python//python:pip.bzl", "pip_parse")
 
 def setup_extra():
@@ -9,7 +8,7 @@ def setup_extra():
     envoy_python_dependencies()
     pip_parse(
         name = "envoy_apt_pip3",
-        python_interpreter_target = interpreter,
+        python_interpreter_target = "@python3_12_host//:python",
         requirements_lock = "//tools:requirements.txt",
         extra_pip_args = ["--require-hashes"],
     )
diff --git a/tools/fetch/BUILD b/tools/fetch/BUILD
index 35a3c1a..fe8f7af 100644
--- a/tools/fetch/BUILD
+++ b/tools/fetch/BUILD
@@ -1,10 +1,8 @@
-load("@envoy_apt_pip3//:requirements.bzl", "requirement", base_entry_point = "entry_point")
-load("@envoy_toolshed//py:macros.bzl", "entry_point")
+load("@rules_python//python/entry_points:py_console_script_binary.bzl", "py_console_script_binary")
 
-entry_point(
+py_console_script_binary(
     name = "fetch",
-    pkg = "envoy.base.utils",
+    pkg = "@envoy_apt_pip3//envoy_base_utils",
     script = "envoy.fetch",
-    entry_point_alias = base_entry_point,
     visibility = ["//visibility:public"],
 )
diff --git a/versions.bzl b/versions.bzl
index 1b202cb..6c18b38 100644
--- a/versions.bzl
+++ b/versions.bzl
@@ -41,32 +41,32 @@ VERSIONS = {
     "com_google_protobuf": {
         "type": "github_archive",
         "repo": "protocolbuffers/protobuf",
-        "version": "26.1",
-        "sha256": "4fc5ff1b2c339fb86cd3a25f0b5311478ab081e65ad258c6789359cd84d421f8",
+        "version": "28.3",
+        "sha256": "7c3ebd7aaedd86fa5dc479a0fda803f602caaf78d8aff7ce83b89e1b8ae7442a",
         "urls": ["https://github.com/{repo}/releases/download/v{version}/protobuf-{version}.tar.gz"],
         "strip_prefix": "protobuf-{version}",
     },
     "envoy": {
         "type": "github_archive",
         "repo": "envoyproxy/envoy",
-        "version": "d3353c7999f661f8d15dcf80e594bad8d31980b5",
-        "sha256": "32c05585933bc4e226f1c8843ccdc7949ef20d285431c5d1a50a4cbe0debcacf",
+        "version": "cb46fd4ce20d38b647ac5ef3d5fb92d9146ccde6",
+        "sha256": "dc7541573df4bc96f6ccbf058763ed457fb25a8fb205ae7de21d4f0f8bcc34a2",
         "urls": ["https://github.com/{repo}/archive/{version}.tar.gz"],
         "strip_prefix": "envoy-{version}",
     },
     "envoy_toolshed": {
         "type": "github_archive",
         "repo": "envoyproxy/toolshed",
-        "version": "0.1.11",
-        "sha256": "f868812bff7ae372e4b53d565ee75a999d33e09b2980cc0c3dfa40684f85bbda",
+        "version": "0.2.0",
+        "sha256": "ef5e95580c41f6805beec197d9a4f6683550f4bfc1e1c678449b6d205dbf000b",
         "urls": ["https://github.com/{repo}/archive/bazel-v{version}.tar.gz"],
         "strip_prefix": "toolshed-bazel-v{version}/bazel",
     },
     "envoy-website": {
         "type": "github_archive",
         "repo": "envoyproxy/envoy-website",
-        "version": "e79ef05416554ab494d7427fbe5ceff78da4ea3e",
-        "sha256": "5bd82c1c7bdd4e8bc063a9067bfef24e4aeba9716c1cc7a965ae4100cfcf80ea",
+        "version": "4733bc4a16a1729e396999e75cd2be0912afb238",
+        "sha256": "da3848be9d8a425ca25b7ae42f973520cf65838a71d60fdbe04f51c008917bcb",
         "urls": ["https://github.com/{repo}/archive/{version}.tar.gz"],
         "strip_prefix": "envoy-website-{version}",
     },
@@ -80,6 +80,14 @@ VERSIONS = {
             "https://github.com/{repo}/releases/download/v{version}/rules_go-v{version}.zip",
         ],
     },
+    "rules_cc": {
+        "type": "github_archive",
+        "repo": "bazelbuild/rules_cc",
+        "version": "0.0.17",
+        "sha256": "abc605dd850f813bb37004b77db20106a19311a96b2da1c92b789da529d28fe1",
+        "urls": ["https://github.com/{repo}/archive/refs/tags/{version}.tar.gz"],
+        "strip_prefix": "rules_cc-{version}",
+    },
     "rules_pkg": {
         "type": "github_archive",
         "repo": "bazelbuild/rules_pkg",
@@ -91,16 +99,16 @@ VERSIONS = {
     "rules_proto": {
         "type": "github_archive",
         "repo": "bazelbuild/rules_proto",
-        "version": "6.0.2",
-        "sha256": "6fb6767d1bef535310547e03247f7518b03487740c11b6c6adb7952033fe1295",
+        "version": "7.0.2",
+        "sha256": "0e5c64a2599a6e26c6a03d6162242d231ecc0de219534c38cb4402171def21e8",
         "urls": ["https://github.com/{repo}/archive/refs/tags/{version}.tar.gz"],
         "strip_prefix": "rules_proto-{version}",
     },
     "rules_python": {
         "type": "github_archive",
         "repo": "bazelbuild/rules_python",
-        "version": "0.32.2",
-        "sha256": "4912ced70dc1a2a8e4b86cec233b192ca053e82bc72d877b98e126156e8f228d",
+        "version": "1.0.0",
+        "sha256": "4f7e2aa1eb9aa722d96498f5ef514f426c1f55161c3c9ae628c857a7128ceb07",
         "urls": ["https://github.com/{repo}/archive/{version}.tar.gz"],
         "strip_prefix": "rules_python-{version}",
     },