diff --git a/.bazelrc b/.bazelrc
index ba39fad1feb1..9c7d6351e01e 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -20,10 +20,7 @@ build --test_env=ENABLE_BAZEL_PACKAGES_LOAD_HACK=true
 
 # Needed by https://github.com/uber/bazel-zig-cc which we use to cross-compile
 # CGo code for cmd/symbols to be used in containers.
-build:incompat-zig-linux-amd64 --incompatible_enable_cc_toolchain_resolution
-build:incompat-zig-linux-amd64 --platforms @zig_sdk//platform:linux_amd64
-build:incompat-zig-linux-amd64 --extra_toolchains @zig_sdk//toolchain:linux_amd64_musl
-
+build --incompatible_enable_cc_toolchain_resolution
 
 # Except in CI run E2E tests in headless mode
 try-import %workspace%/user.bazelrc
diff --git a/cmd/server/build-bazel.sh b/cmd/server/build-bazel.sh
index c11b161ae471..04b1acc9a484 100755
--- a/cmd/server/build-bazel.sh
+++ b/cmd/server/build-bazel.sh
@@ -57,37 +57,33 @@ MUSL_TARGETS=(
 
 if [[ "${ENTERPRISE:-"false"}" == "false" ]]; then
   MUSL_TARGETS+=(//cmd/symbols)
+  exit $?
 else
   MUSL_TARGETS+=(//enterprise/cmd/symbols)
 fi
 
-bazelrc=(
-  --bazelrc=.bazelrc
-)
-if [[ ${CI:-""} == "true" ]]; then
-  bazelrc+=(
-    --bazelrc=.aspect/bazelrc/ci.bazelrc
-    --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc
-  )
-fi
-
 echo "--- bazel build musl"
 bazel \
-  "${bazelrc[@]}"
+  --bazelrc=.bazelrc \
+  --bazelrc=.aspect/bazelrc/ci.bazelrc \
+  --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc \
   build \
   "${MUSL_TARGETS[@]}" \
   --stamp \
   --workspace_status_command=./dev/bazel_stamp_vars.sh \
-  --config incompat-zig-linux-amd64
+  --platforms @zig_sdk//platform:linux_amd64 \
+  --extra_toolchains @zig_sdk//toolchain:linux_amd64_musl
 
 for MUSL_TARGET in "${MUSL_TARGETS[@]}"; do
-  out=$(bazel
-    "${bazelrc[@]}"
+  out=$(bazel --bazelrc=.bazelrc \
+    --bazelrc=.aspect/bazelrc/ci.bazelrc \
+    --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc \
     cquery \
     "$MUSL_TARGET" \
     --stamp \
     --workspace_status_command=./dev/bazel_stamp_vars.sh \
-    --config incompat-zig-linux-amd64 \
+    --platforms @zig_sdk//platform:linux_amd64 \
+    --extra_toolchains @zig_sdk//toolchain:linux_amd64_musl \
     --output=files)
   cp "$out" "$BINDIR"
   echo "copying $MUSL_TARGET"
@@ -95,6 +91,7 @@ done
 
 if [[ "${ENTERPRISE:-"false"}" == "false" ]]; then
   TARGETS=("${OSS_TARGETS[@]}")
+  exit $?
 else
   TARGETS=("${ENTERPRISE_TARGETS[@]}")
 fi
diff --git a/cmd/symbols/build-bazel.sh b/cmd/symbols/build-bazel.sh
index 91ef8ae50a52..66d2c4311fcf 100755
--- a/cmd/symbols/build-bazel.sh
+++ b/cmd/symbols/build-bazel.sh
@@ -12,31 +12,25 @@ cleanup() {
 trap cleanup EXIT
 
 echo "--- bazel build"
-
-bazelrc=(
-  --bazelrc=.bazelrc
-)
-if [[ ${CI:-""} == "true" ]]; then
-  bazelrc+=(
-    --bazelrc=.aspect/bazelrc/ci.bazelrc
-    --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc
-  )
-fi
-
-
-bazel "${bazelrc[@]}" \
-  build \
+bazel build \
+  --bazelrc=.bazelrc \
+  --bazelrc=.aspect/bazelrc/ci.bazelrc \
+  --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc \
   //cmd/symbols \
   --stamp \
   --workspace_status_command=./dev/bazel_stamp_vars.sh \
-  --config incompat-zig-linux-amd64
+  --platforms @zig_sdk//platform:linux_amd64 \
+  --extra_toolchains @zig_sdk//toolchain:linux_amd64_musl
 
 out=$(
-  bazel "${bazelrc[@]}" \
-    cquery //cmd/symbols \
+  bazel build \
+    --bazelrc=.bazelrc \
+    --bazelrc=.aspect/bazelrc/ci.bazelrc \
+    --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc \ cquery //cmd/symbols \
     --stamp \
     --workspace_status_command=./dev/bazel_stamp_vars.sh \
-    --config incompat-zig-linux-amd64 \
+    --platforms @zig_sdk//platform:linux_amd64 \
+    --extra_toolchains @zig_sdk//toolchain:linux_amd64_musl \
     --output=files
 )
 cp "$out" "$OUTPUT"
diff --git a/enterprise/cmd/symbols/build-bazel.sh b/enterprise/cmd/symbols/build-bazel.sh
index fc2e6a9e69b7..ea51e2224a98 100755
--- a/enterprise/cmd/symbols/build-bazel.sh
+++ b/enterprise/cmd/symbols/build-bazel.sh
@@ -3,7 +3,7 @@
 # This script builds the symbols docker image.
 
 cd "$(dirname "${BASH_SOURCE[0]}")/../../.."
-set -eu
+set -eux
 
 OUTPUT=$(mktemp -d -t sgdockerbuild_XXXXXXX)
 cleanup() {
@@ -11,33 +11,28 @@ cleanup() {
 }
 trap cleanup EXIT
 
-bazelrc=(
-  --bazelrc=.bazelrc
-)
-if [[ ${CI:-""} == "true" ]]; then
-  bazelrc+=(
-    --bazelrc=.aspect/bazelrc/ci.bazelrc
-    --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc
-  )
-fi
-
 echo "--- bazel build"
 bazel \
-  "${bazelrc[@]}" \
+  --bazelrc=.bazelrc \
+  --bazelrc=.aspect/bazelrc/ci.bazelrc \
+  --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc \
   build \
   //enterprise/cmd/symbols \
   --stamp \
   --workspace_status_command=./dev/bazel_stamp_vars.sh \
-  --config incompat-zig-linux-amd64
+  --platforms @zig_sdk//platform:linux_amd64 \
+  --extra_toolchains @zig_sdk//toolchain:linux_amd64_musl
 
 out=$(
-  bazel \
-    "${bazelrc[@]}" \
+  bazel --bazelrc=.bazelrc \
+    --bazelrc=.aspect/bazelrc/ci.bazelrc \
+    --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc \
     cquery \
     //enterprise/cmd/symbols \
     --stamp \
     --workspace_status_command=./dev/bazel_stamp_vars.sh \
-    --config incompat-zig-linux-amd64 \
+    --platforms @zig_sdk//platform:linux_amd64 \
+    --extra_toolchains @zig_sdk//toolchain:linux_amd64_musl \
     --output=files
 )
 cp "$out" "$OUTPUT"
diff --git a/enterprise/dev/app/build-backend.sh b/enterprise/dev/app/build-backend.sh
index 72449a54ac15..3490e1582c25 100755
--- a/enterprise/dev/app/build-backend.sh
+++ b/enterprise/dev/app/build-backend.sh
@@ -65,7 +65,6 @@ bazel_build() {
   # for more info see the BUILD.bazel file in enterprise/cmd/sourcegraph
   if [[ ${CROSS_COMPILE_X86_64_MACOS:-0} == 1 ]]; then
     bazel_target="//enterprise/cmd/sourcegraph:sourcegraph_x86_64_darwin"
-    # we don't use the incompat-zig-linux-amd64 bazel config here, since we need bazel to pick up the host cc
     bazel_opts="${bazel_opts} --platforms @zig_sdk//platform:darwin_amd64 --extra_toolchains @zig_sdk//toolchain:darwin_amd64"
   fi