diff --git a/MODULE.bazel b/MODULE.bazel
index fe82dabe8039c2..b6f5fdc5c05cb4 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -16,7 +16,7 @@ bazel_dep(name = "stardoc", version = "0.5.3", repo_name = "io_bazel_skydoc")
 bazel_dep(name = "zstd-jni", version = "1.5.2-3")
 bazel_dep(name = "zlib", version = "1.2.13")
 bazel_dep(name = "rules_cc", version = "0.0.6")
-bazel_dep(name = "rules_java", version = "6.0.0")
+bazel_dep(name = "rules_java", version = "5.5.0")
 bazel_dep(name = "rules_proto", version = "5.3.0-21.7")
 bazel_dep(name = "rules_jvm_external", version = "4.5")
 bazel_dep(name = "rules_python", version = "0.19.0")
diff --git a/WORKSPACE b/WORKSPACE
index 1ee184629f2a87..9fd1b7c737e0a9 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -1,9 +1,10 @@
 workspace(name = "io_bazel")
 
 load("//tools/build_defs/repo:http.bzl", "http_archive")
-load("//:distdir.bzl", "dist_http_archive", "distdir_tar", "dist_http_jar")
+load("//:distdir.bzl", "dist_http_archive", "dist_http_jar", "distdir_tar")
 load("//:distdir_deps.bzl", "DIST_DEPS")
 load("//:repositories.bzl", "embedded_jdk_repositories")
+load("//tools/jdk:jdk_build_file.bzl", "JDK_BUILD_TEMPLATE")
 
 # These can be used as values for the patch_cmds and patch_cmds_win attributes
 # of http_archive, in order to export the WORKSPACE file from the BUILD or
@@ -236,6 +237,7 @@ java_library(
     ],
 )
 
+# Used in src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.
 dist_http_archive(
     name = "rules_cc",
     patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
@@ -254,6 +256,26 @@ dist_http_archive(
     patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
 )
 
+# For testing, have an distdir_tar with all the archives implicit in every
+# WORKSPACE, to that they don't have to be refetched for every test
+# calling `bazel sync`.
+distdir_tar(
+    name = "test_WORKSPACE_files",
+    archives = [
+        "android_tools_pkg-0.28.0.tar",
+    ],
+    dirname = "test_WORKSPACE/distdir",
+    dist_deps = {dep: attrs for dep, attrs in DIST_DEPS.items() if "test_WORKSPACE_files" in attrs["used_in"]},
+    sha256 = {
+        "android_tools_pkg-0.28.0.tar": "db3b02421ae974e0b33573f3e4f658d5f89cc9a0b42baae0ba2ac08e25c0720a",
+    },
+    urls = {
+        "android_tools_pkg-0.28.0.tar": [
+            "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.28.0.tar",
+        ],
+    },
+)
+
 dist_http_archive(
     name = "io_bazel_skydoc",
 )
@@ -287,9 +309,208 @@ dist_http_archive(
     patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
 )
 
-load("@rules_java//java:repositories.bzl", "rules_java_dependencies", "rules_java_toolchains")
-rules_java_dependencies()
-rules_java_toolchains()
+dist_http_archive(
+    name = "remotejdk11_linux_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "remotejdk11_linux_aarch64_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "remotejdk11_linux_ppc64le_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "remotejdk11_linux_s390x_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "remotejdk11_macos_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "remotejdk11_macos_aarch64_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "remotejdk11_win_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "remotejdk11_win_arm64_for_testing",
+    build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = 11),
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+)
+
+[
+    dist_http_archive(
+        name = "remotejdk%s_%s_for_testing" % (version, os),
+        build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = version),
+        patch_cmds = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE,
+        patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_BAZEL_FILE_WIN,
+    )
+    for version in ("17", "20")
+    for os in ("linux", "macos", "macos_aarch64", "win") + (("linux_s390x", "win_arm64") if version != "20" else ())
+]
+
+# Used in src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.
+dist_http_archive(
+    name = "remote_java_tools_for_testing",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.
+dist_http_archive(
+    name = "remote_java_tools_linux_for_testing",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.
+dist_http_archive(
+    name = "remote_java_tools_windows_for_testing",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.
+dist_http_archive(
+    name = "remote_java_tools_darwin_x86_64_for_testing",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.
+dist_http_archive(
+    name = "remote_java_tools_darwin_arm64_for_testing",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "remote_java_tools_test",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "remote_java_tools_test_linux",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "remote_java_tools_test_windows",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "remote_java_tools_test_darwin_x86_64",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+# Used in src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "remote_java_tools_test_darwin_arm64",
+    patch_cmds = EXPORT_WORKSPACE_IN_BUILD_FILE,
+    patch_cmds_win = EXPORT_WORKSPACE_IN_BUILD_FILE_WIN,
+)
+
+dist_http_archive(
+    name = "openjdk11_linux_archive",
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "openjdk11_linux_s390x_archive",
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "openjdk11_darwin_archive",
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "openjdk11_darwin_aarch64_archive",
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "openjdk11_windows_archive",
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+dist_http_archive(
+    name = "openjdk11_windows_arm64_archive",
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+[
+    dist_http_archive(
+        name = "openjdk%s_%s_archive" % (version, os),
+        build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+    )
+    for version in ("17", "20")
+    for os in ("linux", "darwin", "darwin_aarch64", "windows") + (("linux_s390x", "windows_arm64") if version != "20" else ())
+]
 
 load("@io_bazel_skydoc//:setup.bzl", "stardoc_repositories")
 
diff --git a/distdir_deps.bzl b/distdir_deps.bzl
index 5136dfc975e158..28a35ea6d2cdd1 100644
--- a/distdir_deps.bzl
+++ b/distdir_deps.bzl
@@ -33,6 +33,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "package_version": "0.0.6",
     },
@@ -58,21 +59,26 @@ DIST_DEPS = {
         "urls": ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.6/rules_cc-0.0.6.tar.gz"],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "package_version": "0.0.6",
         "strip_prefix": "rules_cc-0.0.6",
     },
     "rules_java": {
-        "archive": "rules_java-6.0.0.tar.gz",
-        "sha256": "469b7f3b580b4fcf8112f4d6d0d5a4ce8e1ad5e21fee67d8e8335d5f8b3debab",
-        "urls": ["https://github.com/bazelbuild/rules_java/releases/download/6.0.0/rules_java-6.0.0.tar.gz"],
+        "archive": "rules_java-5.4.1.tar.gz",
+        "sha256": "a1f82b730b9c6395d3653032bd7e3a660f9d5ddb1099f427c1e1fe768f92e395",
+        "strip_prefix": "",
+        "urls": [
+            "https://github.com/bazelbuild/rules_java/releases/download/5.4.1/rules_java-5.4.1.tar.gz",
+        ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "license_kinds": [
             "@rules_license//licenses/spdx:Apache-2.0",
         ],
-        "package_version": "6.0.0",
+        "package_version": "5.4.1",
     },
     # Used in src/test/java/com/google/devtools/build/lib/blackbox/framework/blackbox.WORKSAPCE
     "rules_proto": {
@@ -84,6 +90,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "license_kinds": [
             "@rules_license//licenses/spdx:Apache-2.0",
@@ -106,6 +113,7 @@ DIST_DEPS = {
         "patches": ["//third_party/protobuf:21.7.patch"],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "license_kinds": [
             "@rules_license//licenses/generic:notice",
@@ -128,6 +136,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "package_version": "1.48.1",
     },
@@ -145,6 +154,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
     },
     "com_envoyproxy_protoc_gen_validate": {
@@ -161,6 +171,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
     },
     "bazel_gazelle": {
@@ -172,6 +183,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "package_version": "0.24.0",
     },
@@ -185,6 +197,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "license_kinds": [
             "@rules_license//licenses/spdx:Apache-2.0",
@@ -201,6 +214,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "license_kinds": [
             "@rules_license//licenses/generic:notice",
@@ -216,6 +230,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
     },
     "re2": {
@@ -227,6 +242,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
     },
     "com_google_absl": {
@@ -238,6 +254,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "strip_prefix": "abseil-cpp-20220623.1",
         "license_kinds": [
@@ -278,6 +295,7 @@ DIST_DEPS = {
             "https://maven.google.com/com/android/tools/r8/8.0.40/r8-8.0.40.jar",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
         "package_version": "8.0.40",
     },
@@ -290,6 +308,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "package_version": "1.3.0",
     },
@@ -314,6 +333,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "package_version": "0.0.3",
     },
@@ -326,6 +346,7 @@ DIST_DEPS = {
         ],
         "used_in": [
             "additional_distfiles",
+            "test_WORKSPACE_files",
         ],
         "package_version": "0.8.0",
     },
@@ -350,7 +371,7 @@ DIST_DEPS = {
         "strip_prefix": "rules_python-0.19.0",
         "urls": ["https://github.com/bazelbuild/rules_python/releases/download/0.19.0/rules_python-0.19.0.tar.gz"],
         "archive": "rules_python-0.19.0.tar.gz",
-        "used_in": ["additional_distfiles"],
+        "used_in": ["additional_distfiles", "test_WORKSPACE_files"],
     },
     "rules_testing": {
         "sha256": "4e21f9aa7996944ce91431f27bca374bff56e680acfe497276074d56bc5d9af2",
@@ -360,7 +381,7 @@ DIST_DEPS = {
             "https://github.com/bazelbuild/rules_testing/releases/download/v0.0.4/rules_testing-v0.0.4.tar.gz",
         ],
         "archive": "rules_testing-v0.0.4.tar.gz",
-        "used_in": ["additional_distfiles"],
+        "used_in": ["additional_distfiles", "test_WORKSPACE_files"],
         "package_version": "0.0.4",
     },
     "desugar_jdk_libs": {
@@ -383,10 +404,220 @@ DIST_DEPS = {
             "https://mirror.bazel.build/bazel_coverage_output_generator/releases/coverage_output_generator-v2.6.zip",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
         "package_version": "2.6",
     },
-    "openjdk_linux_vanilla": {
+    "remote_java_tools": {
+        "aliases": [
+            "remote_java_tools_test",
+            "remote_java_tools_for_testing",
+        ],
+        "archive": "java_tools-v12.3.zip",
+        "sha256": "cbb62ecfef61568ded46260a8e8e8430755db7ec9638c0c7ff668a656f6c042f",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v12.3/java_tools-v12.3.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v12.3/java_tools-v12.3.zip",
+        ],
+        "used_in": [
+            "test_WORKSPACE_files",
+        ],
+        "package_version": "12.3",
+    },
+    "remote_java_tools_linux": {
+        "aliases": [
+            "remote_java_tools_test_linux",
+            "remote_java_tools_linux_for_testing",
+        ],
+        "archive": "java_tools_linux-v12.3.zip",
+        "sha256": "32157b5218b151009f5b99bf5e2f65e28823d269dfbba8cd57e7da5e7cdd291d",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v12.3/java_tools_linux-v12.3.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v12.3/java_tools_linux-v12.3.zip",
+        ],
+        "used_in": [
+            "test_WORKSPACE_files",
+        ],
+        "package_version": "12.3",
+    },
+    "remote_java_tools_windows": {
+        "aliases": [
+            "remote_java_tools_test_windows",
+            "remote_java_tools_windows_for_testing",
+        ],
+        "archive": "java_tools_windows-v12.3.zip",
+        "sha256": "ec6f91387d2353eacb0ca0492f35f68c5c7b0e7a80acd1fb825088b4b069fab1",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v12.3/java_tools_windows-v12.3.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v12.3/java_tools_windows-v12.3.zip",
+        ],
+        "used_in": [
+            "test_WORKSPACE_files",
+        ],
+        "package_version": "12.3",
+    },
+    "remote_java_tools_darwin_x86_64": {
+        "aliases": [
+            "remote_java_tools_test_darwin_x86_64",
+            "remote_java_tools_darwin_x86_64_for_testing",
+        ],
+        "archive": "java_tools_darwin_x86_64-v12.3.zip",
+        "sha256": "3c3fb1967a0f35c73ff509505de53ca4611518922a6b7c8c22a468aa7503132c",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v12.3/java_tools_darwin_x86_64-v12.3.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v12.3/java_tools_darwin_x86_64-v12.3.zip",
+        ],
+        "used_in": [
+            "test_WORKSPACE_files",
+        ],
+        "package_version": "12.3",
+    },
+    "remote_java_tools_darwin_arm64": {
+        "aliases": [
+            "remote_java_tools_test_darwin_arm64",
+            "remote_java_tools_darwin_arm64_for_testing",
+        ],
+        "archive": "java_tools_darwin_arm64-v12.3.zip",
+        "sha256": "29aa0c2de4e3cf45bc55d2995ba803ecbd1173a8d363860abbc309551db7931b",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/java/v12.3/java_tools_darwin_arm64-v12.3.zip",
+            "https://github.com/bazelbuild/java_tools/releases/download/java_v12.3/java_tools_darwin_arm64-v12.3.zip",
+        ],
+        "used_in": [
+            "test_WORKSPACE_files",
+        ],
+        "package_version": "12.3",
+    },
+    "remotejdk11_linux": {
+        "aliases": [
+            "remotejdk11_linux_for_testing",
+            "openjdk11_linux_archive",
+        ],
+        "archive": "zulu11.56.19-ca-jdk11.0.15-linux_x64.tar.gz",
+        "sha256": "e064b61d93304012351242bf0823c6a2e41d9e28add7ea7f05378b7243d34247",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-linux_x64.tar.gz",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk11_linux_aarch64": {
+        "aliases": [
+            "remotejdk11_linux_aarch64_for_testing",
+        ],
+        "archive": "zulu11.56.19-ca-jdk11.0.15-linux_aarch64.tar.gz",
+        "sha256": "fc7c41a0005180d4ca471c90d01e049469e0614cf774566d4cf383caa29d1a97",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-linux_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu-embedded/bin/zulu11.56.19-ca-jdk11.0.15-linux_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu-embedded/bin/zulu11.56.19-ca-jdk11.0.15-linux_aarch64.tar.gz",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk11_linux_ppc64le": {
+        "aliases": [
+            "remotejdk11_linux_ppc64le_for_testing",
+        ],
+        "sha256": "a8fba686f6eb8ae1d1a9566821dbd5a85a1108b96ad857fdbac5c1e4649fc56f",
+        "strip_prefix": "jdk-11.0.15+10",
+        "urls": [
+            "https://mirror.bazel.build/github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.15_10.tar.gz",
+            "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.15_10.tar.gz",
+        ],
+        "used_in": [],
+    },
+    "remotejdk11_linux_s390x": {
+        "aliases": [
+            "remotejdk11_linux_s390x_for_testing",
+            "openjdk11_linux_s390x_archive",
+        ],
+        "sha256": "a58fc0361966af0a5d5a31a2d8a208e3c9bb0f54f345596fd80b99ea9a39788b",
+        "strip_prefix": "jdk-11.0.15+10",
+        "urls": [
+            "https://mirror.bazel.build/github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.15_10.tar.gz",
+            "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.15+10/OpenJDK11U-jdk_s390x_linux_hotspot_11.0.15_10.tar.gz",
+        ],
+        "used_in": [],
+    },
+    "remotejdk11_macos": {
+        "aliases": [
+            "remotejdk11_macos_for_testing",
+            "openjdk11_darwin_archive",
+        ],
+        "archive": "zulu11.56.19-ca-jdk11.0.15-macosx_x64.tar.gz",
+        "sha256": "2614e5c5de8e989d4d81759de4c333aa5b867b17ab9ee78754309ba65c7f6f55",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_x64.tar.gz",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk11_macos_aarch64": {
+        "aliases": [
+            "remotejdk11_macos_aarch64_for_testing",
+            "openjdk11_darwin_aarch64_archive",
+        ],
+        "archive": "zulu11.56.19-ca-jdk11.0.15-macosx_aarch64.tar.gz",
+        "sha256": "6bb0d2c6e8a29dcd9c577bbb2986352ba12481a9549ac2c0bcfd00ed60e538d2",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-macosx_aarch64.tar.gz",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk11_win": {
+        "aliases": [
+            "remotejdk11_win_for_testing",
+            "openjdk11_windows_archive",
+        ],
+        "archive": "zulu11.56.19-ca-jdk11.0.15-win_x64.zip",
+        "sha256": "a106c77389a63b6bd963a087d5f01171bd32aa3ee7377ecef87531390dcb9050",
+        "strip_prefix": "zulu11.56.19-ca-jdk11.0.15-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu11.56.19-ca-jdk11.0.15-win_x64.zip",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk17_win_arm64": {
+        "aliases": [
+            "remotejdk17_win_arm64_for_testing",
+            "openjdk17_windows_arm64_archive",
+            "openjdk_win_arm64_vanilla",
+        ],
+        "archive": "zulu17.38.21-ca-jdk17.0.5-win_aarch64.zip",
+        "sha256": "bc3476f2161bf99bc9a243ff535b8fc033b34ce9a2fa4b62fb8d79b6bfdc427f",
+        "strip_prefix": "zulu17.38.21-ca-jdk17.0.5-win_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-win_aarch64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-win_aarch64.zip",
+        ],
+        "used_in": [
+            "test_WORKSPACE_files",
+        ],
+    },
+    "remotejdk11_win_arm64": {
+        "aliases": [
+            "remotejdk11_win_arm64_for_testing",
+            "openjdk11_windows_arm64_archive",
+        ],
+        "archive": "microsoft-jdk-11.0.13.8.1-windows-aarch64.zip",
+        "sha256": "b8a28e6e767d90acf793ea6f5bed0bb595ba0ba5ebdf8b99f395266161e53ec2",
+        "strip_prefix": "jdk-11.0.13+8",
+        "urls": [
+            "https://mirror.bazel.build/aka.ms/download-jdk/microsoft-jdk-11.0.13.8.1-windows-aarch64.zip",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk17_linux": {
+        "aliases": [
+            "remotejdk17_linux_for_testing",
+            "openjdk17_linux_archive",
+            "openjdk_linux_vanilla",
+        ],
         "archive": "zulu17.38.21-ca-jdk17.0.5-linux_x64.tar.gz",
         "sha256": "20c91a922eec795f3181eaa70def8b99d8eac56047c9a14bfb257c85b991df1b",
         "strip_prefix": "zulu17.38.21-ca-jdk17.0.5-linux_x64",
@@ -395,9 +626,15 @@ DIST_DEPS = {
             "https://cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-linux_x64.tar.gz",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
     },
-    "openjdk_linux_aarch64_vanilla": {
+    "remotejdk17_linux_aarch64": {
+        "aliases": [
+            "remotejdk17_linux_aarch64_for_testing",
+            "openjdk17_linux_aarch64_archive",
+            "openjdk_linux_aarch64_vanilla",
+        ],
         "archive": "zulu17.38.21-ca-jdk17.0.5-linux_aarch64.tar.gz",
         "sha256": "dbc6ae9163e7ff469a9ab1f342cd1bc1f4c1fb78afc3c4f2228ee3b32c4f3e43",
         "strip_prefix": "zulu17.38.21-ca-jdk17.0.5-linux_aarch64",
@@ -406,9 +643,15 @@ DIST_DEPS = {
             "https://cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-linux_aarch64.tar.gz",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
     },
-    "openjdk_linux_s390x_vanilla": {
+    "remotejdk17_linux_s390x": {
+        "aliases": [
+            "remotejdk17_linux_s390x_for_testing",
+            "openjdk17_linux_s390x_archive",
+            "openjdk_linux_s390x_vanilla",
+        ],
         "archive": "OpenJDK17U-jdk_s390x_linux_hotspot_17.0.4.1_1.tar.gz",
         "sha256": "fdc82f4b06c880762503b0cb40e25f46cf8190d06011b3b768f4091d3334ef7f",
         "strip_prefix": "jdk-17.0.4.1+1",
@@ -417,9 +660,14 @@ DIST_DEPS = {
             "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.4.1%2B1/OpenJDK17U-jdk_s390x_linux_hotspot_17.0.4.1_1.tar.gz",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
     },
-    "openjdk_linux_ppc64le_vanilla": {
+    "remotejdk17_linux_ppc64le": {
+        "aliases": [
+            "remotejdk17_linux_ppc64le_for_testing",
+            "openjdk_linux_ppc64le_vanilla",
+        ],
         "archive": "OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.4.1_1.tar.gz",
         "sha256": "cbedd0a1428b3058d156e99e8e9bc8769e0d633736d6776a4c4d9136648f2fd1",
         "strip_prefix": "jdk-17.0.4.1+1",
@@ -429,7 +677,12 @@ DIST_DEPS = {
         ],
         "used_in": [],
     },
-    "openjdk_macos_x86_64_vanilla": {
+    "remotejdk17_macos": {
+        "aliases": [
+            "remotejdk17_macos_for_testing",
+            "openjdk17_darwin_archive",
+            "openjdk_macos_x86_64_vanilla",
+        ],
         "archive": "zulu17.38.21-ca-jdk17.0.5-macosx_x64.tar.gz",
         "sha256": "e6317cee4d40995f0da5b702af3f04a6af2bbd55febf67927696987d11113b53",
         "strip_prefix": "zulu17.38.21-ca-jdk17.0.5-macosx_x64",
@@ -438,9 +691,15 @@ DIST_DEPS = {
             "https://cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-macosx_x64.tar.gz",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
     },
-    "openjdk_macos_aarch64_vanilla": {
+    "remotejdk17_macos_aarch64": {
+        "aliases": [
+            "remotejdk17_macos_aarch64_for_testing",
+            "openjdk17_darwin_aarch64_archive",
+            "openjdk_macos_aarch64_vanilla",
+        ],
         "archive": "zulu17.38.21-ca-jdk17.0.5-macosx_aarch64",
         "sha256": "515dd56ec99bb5ae8966621a2088aadfbe72631818ffbba6e4387b7ee292ab09",
         "strip_prefix": "zulu17.38.21-ca-jdk17.0.5-macosx_aarch64",
@@ -449,9 +708,15 @@ DIST_DEPS = {
             "https://cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-macosx_aarch64.tar.gz",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
     },
-    "openjdk_win_vanilla": {
+    "remotejdk17_win": {
+        "aliases": [
+            "remotejdk17_win_for_testing",
+            "openjdk17_windows_archive",
+            "openjdk_win_vanilla",
+        ],
         "archive": "zulu17.38.21-ca-jdk17.0.5-win_x64.zip",
         "sha256": "9972c5b62a61b45785d3d956c559e079d9e91f144ec46225f5deeda214d48f27",
         "strip_prefix": "zulu17.38.21-ca-jdk17.0.5-win_x64",
@@ -460,18 +725,77 @@ DIST_DEPS = {
             "https://cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-win_x64.zip",
         ],
         "used_in": [
+            "test_WORKSPACE_files",
         ],
     },
-    "openjdk_win_arm64_vanilla": {
-        "archive": "zulu17.38.21-ca-jdk17.0.5-win_aarch64.zip",
-        "sha256": "bc3476f2161bf99bc9a243ff535b8fc033b34ce9a2fa4b62fb8d79b6bfdc427f",
-        "strip_prefix": "zulu17.38.21-ca-jdk17.0.5-win_aarch64",
+    "remotejdk20_linux_aarch64": {
+        "aliases": [
+            "remotejdk20_linux_for_testing",
+        ],
+        "archive": "zulu20.28.85-ca-jdk20.0.0-linux_aarch64.tar.gz",
+        "sha256": "47ce58ead9a05d5d53b96706ff6fa0eb2e46755ee67e2b416925e28f5b55038a",
+        "strip_prefix": "zulu20.28.85-ca-jdk20.0.0-linux_aarch64",
         "urls": [
-            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-win_aarch64.zip",
-            "https://cdn.azul.com/zulu/bin/zulu17.38.21-ca-jdk17.0.5-win_aarch64.zip",
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-linux_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-linux_aarch64.tar.gz",
         ],
-        "used_in": [
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk20_linux": {
+        "aliases": [
+            "remotejdk20_linux_for_testing",
+            "openjdk20_linux_archive",
+        ],
+        "archive": "zulu20.28.85-ca-jdk20.0.0-linux_x64.tar.gz",
+        "sha256": "0386418db7f23ae677d05045d30224094fc13423593ce9cd087d455069893bac",
+        "strip_prefix": "zulu20.28.85-ca-jdk20.0.0-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-linux_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-linux_x64.tar.gz",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk20_macos": {
+        "aliases": [
+            "remotejdk20_macos_for_testing",
+            "openjdk20_darwin_archive",
+        ],
+        "archive": "zulu20.28.85-ca-jdk20.0.0-macosx_x64.tar.gz",
+        "sha256": "fde6cc17a194ea0d9b0c6c0cb6178199d8edfc282d649eec2c86a9796e843f86",
+        "strip_prefix": "zulu20.28.85-ca-jdk20.0.0-macosx_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-macosx_x64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-macosx_x64.tar.gz",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk20_macos_aarch64": {
+        "aliases": [
+            "remotejdk20_macos_aarch64_for_testing",
+            "openjdk20_darwin_aarch64_archive",
+        ],
+        "archive": "zulu20.28.85-ca-jdk20.0.0-macosx_aarch64.tar.gz",
+        "sha256": "a2eff6a940c2df3a2352278027e83f5959f34dcfc8663034fe92be0f1b91ce6f",
+        "strip_prefix": "zulu20.28.85-ca-jdk20.0.0-macosx_aarch64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-macosx_aarch64.tar.gz",
+            "https://cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-macosx_aarch64.tar.gz",
+        ],
+        "used_in": ["test_WORKSPACE_files"],
+    },
+    "remotejdk20_win": {
+        "aliases": [
+            "remotejdk20_win_for_testing",
+            "openjdk20_windows_archive",
+        ],
+        "archive": "zulu20.28.85-ca-jdk20.0.0-win_x64.zip",
+        "sha256": "ac5f6a7d84dbbb0bb4d376feb331cc4c49a9920562f2a5e85b7a6b4863b10e1e",
+        "strip_prefix": "zulu20.28.85-ca-jdk20.0.0-win_x64",
+        "urls": [
+            "https://mirror.bazel.build/cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-win_x64.zip",
+            "https://cdn.azul.com/zulu/bin/zulu20.28.85-ca-jdk20.0.0-win_x64.zip",
         ],
+        "used_in": ["test_WORKSPACE_files"],
     },
 }
 
diff --git a/scripts/bootstrap/BUILD.bootstrap b/scripts/bootstrap/BUILD.bootstrap
index a75e9062f7cc91..825d95886d725a 100644
--- a/scripts/bootstrap/BUILD.bootstrap
+++ b/scripts/bootstrap/BUILD.bootstrap
@@ -3,7 +3,7 @@ load("@bazel_tools//tools/jdk:default_java_toolchain.bzl", "default_java_toolcha
 # This toolchain is used to bootstrap Bazel.
 default_java_toolchain(
     name = "bootstrap_toolchain",
-    bootclasspath = ["@bazel_tools//tools/jdk:platformclasspath"],
+    bootclasspath = ["@bazel_tools//tools/jdk:platformclasspath.jar"],
     genclass = ["//src/java_tools/buildjar:bootstrap_genclass_deploy.jar"],
     header_compiler = None,  # avoid remote_java_tools dependency
     header_compiler_direct = None,  # ditto
diff --git a/src/BUILD b/src/BUILD
index 1144dccc7e9c28..fd99902bda1611 100644
--- a/src/BUILD
+++ b/src/BUILD
@@ -564,19 +564,24 @@ filegroup(
         "@bazel_skylib//:WORKSPACE",
         "@com_google_protobuf//:WORKSPACE",
         "@remote_coverage_tools//:WORKSPACE",
-        "@remote_java_tools//:GenClass",
-        "@remote_java_tools_darwin_arm64//:java_tools/src/tools/singlejar/singlejar_local",
-        "@remote_java_tools_darwin_x86_64//:java_tools/src/tools/singlejar/singlejar_local",
-        "@remote_java_tools_linux//:java_tools/src/tools/singlejar/singlejar_local",
-        "@remote_java_tools_windows//:java_tools/src/tools/singlejar/singlejar_local.exe",
-        "@remotejdk11_linux//:WORKSPACE",
-        "@remotejdk11_linux_aarch64//:WORKSPACE",
-        "@remotejdk11_linux_ppc64le//:WORKSPACE",
-        "@remotejdk11_linux_s390x//:WORKSPACE",
-        "@remotejdk11_macos//:WORKSPACE",
-        "@remotejdk11_macos_aarch64//:WORKSPACE",
-        "@remotejdk11_win//:WORKSPACE",
-        "@remotejdk11_win_arm64//:WORKSPACE",
+        "@remote_java_tools_darwin_arm64_for_testing//:WORKSPACE",
+        "@remote_java_tools_darwin_x86_64_for_testing//:WORKSPACE",
+        "@remote_java_tools_for_testing//:WORKSPACE",
+        "@remote_java_tools_linux_for_testing//:WORKSPACE",
+        "@remote_java_tools_test//:WORKSPACE",
+        "@remote_java_tools_test_darwin_arm64//:WORKSPACE",
+        "@remote_java_tools_test_darwin_x86_64//:WORKSPACE",
+        "@remote_java_tools_test_linux//:WORKSPACE",
+        "@remote_java_tools_test_windows//:WORKSPACE",
+        "@remote_java_tools_windows_for_testing//:WORKSPACE",
+        "@remotejdk11_linux_aarch64_for_testing//:WORKSPACE",
+        "@remotejdk11_linux_for_testing//:WORKSPACE",
+        "@remotejdk11_linux_ppc64le_for_testing//:WORKSPACE",
+        "@remotejdk11_linux_s390x_for_testing//:WORKSPACE",
+        "@remotejdk11_macos_aarch64_for_testing//:WORKSPACE",
+        "@remotejdk11_macos_for_testing//:WORKSPACE",
+        "@remotejdk11_win_arm64_for_testing//:WORKSPACE",
+        "@remotejdk11_win_for_testing//:WORKSPACE",
         "@rules_cc//:WORKSPACE",
         "@rules_java//:WORKSPACE",
         "@rules_pkg//:WORKSPACE",
@@ -584,7 +589,11 @@ filegroup(
         "@rules_python//:WORKSPACE",
         "@rules_testing//:WORKSPACE.bazel",
     ] + [
-        "@remotejdk%s_%s//:WORKSPACE" % (version, os)
+        "@openjdk%s_%s_archive//:WORKSPACE" % (version, os)
+        for version in ("17", "20")
+        for os in ("darwin", "darwin_aarch64", "linux", "windows") + (("linux_s390x", "windows_arm64") if version != "20" else ())
+    ] + [
+        "@remotejdk%s_%s_for_testing//:WORKSPACE" % (version, os)
         for version in ("17", "20")
         for os in ("macos", "macos_aarch64", "linux", "win") + (("linux_s390x", "win_arm64") if version != "20" else ())
     ],
diff --git a/src/MODULE.tools b/src/MODULE.tools
index 1905a29f08ccf7..2081aa437be655 100644
--- a/src/MODULE.tools
+++ b/src/MODULE.tools
@@ -1,7 +1,7 @@
 module(name = "bazel_tools")
 
 bazel_dep(name = "rules_cc", version = "0.0.6")
-bazel_dep(name = "rules_java", version = "6.0.0")
+bazel_dep(name = "rules_java", version = "5.5.0")
 bazel_dep(name = "rules_license", version = "0.0.3")
 bazel_dep(name = "rules_proto", version = "4.0.0")
 bazel_dep(name = "rules_python", version = "0.4.0")
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BUILD b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BUILD
index 30e3510ea149a1..2eca68c765b549 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BUILD
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BUILD
@@ -89,10 +89,27 @@ gen_workspace_stanza(
     urls = {urls},
     """,
     repos = [
+        "remote_java_tools",
+        "remote_java_tools_linux",
+        "remote_java_tools_windows",
+        "remote_java_tools_darwin_x86_64",
+        "remote_java_tools_darwin_arm64",
         "rules_cc",
         "rules_java",
         "rules_proto",
         "rules_python",
+        "remotejdk11_linux",
+        "remotejdk11_linux_aarch64",
+        "remotejdk11_linux_ppc64le",
+        "remotejdk11_linux_s390x",
+        "remotejdk11_macos",
+        "remotejdk11_macos_aarch64",
+        "remotejdk11_win",
+        "remotejdk11_win_arm64",
+    ] + [
+        "remotejdk%s_%s" % (version, os)
+        for version in ("17", "20")
+        for os in ("macos", "macos_aarch64", "linux", "linux_aarch64", "win") + (("linux_s390x", "win_arm64") if version != "20" else ())
     ],
     template = "jdk.WORKSPACE.tmpl",
     visibility = ["//:__pkg__"],
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.tmpl b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.tmpl
index d96ab0ce960f7e..38320c0a3a79b3 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.tmpl
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE.tmpl
@@ -1,6 +1,266 @@
 # External dependencies for the java_* rules.
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+load("@bazel_tools//tools/jdk:jdk_build_file.bzl", "JDK_BUILD_TEMPLATE")
+load("@bazel_tools//tools/jdk:local_java_repository.bzl", "local_java_repository")
+load("@bazel_tools//tools/jdk:remote_java_repository.bzl", "remote_java_repository")
+
+maybe(
+    local_java_repository,
+    name = "local_jdk",
+    java_home = DEFAULT_SYSTEM_JAVABASE,
+    build_file_content = JDK_BUILD_TEMPLATE,
+)
+
+# OpenJDK distributions that should only be downloaded on demand (e.g. when
+# building a java_library or a genrule that uses java make variables).
+# This will allow us to stop bundling the full JDK with Bazel.
+# Note that while these are currently the same as the openjdk_* rules in
+# Bazel's WORKSPACE file, but they don't have to be the same.
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_linux}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_linux_aarch64}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:aarch64",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_linux_ppc64le}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:ppc",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_linux_s390x}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:s390x",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_macos}
+    target_compatible_with = [
+        "@platforms//os:macos",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_macos_aarch64}
+    target_compatible_with = [
+        "@platforms//os:macos",
+        "@platforms//cpu:aarch64",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_win}
+    target_compatible_with = [
+        "@platforms//os:windows",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk11_win_arm64}
+    target_compatible_with = [
+        "@platforms//os:windows",
+        "@platforms//cpu:arm64",
+    ],
+    version = "11",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk17_linux}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "17",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk17_linux_aarch64}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:aarch64",
+    ],
+    version = "17",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk17_linux_s390x}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:s390x",
+    ],
+    version = "17",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk17_macos}
+    target_compatible_with = [
+        "@platforms//os:macos",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "17",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk17_macos_aarch64}
+    target_compatible_with = [
+        "@platforms//os:macos",
+        "@platforms//cpu:aarch64",
+    ],
+    version = "17",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk17_win}
+    target_compatible_with = [
+        "@platforms//os:windows",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "17",
+)
+
+maybe(
+    remote_java_repository,
+    {remotejdk17_win_arm64}
+    target_compatible_with = [
+        "@platforms//os:windows",
+        "@platforms//cpu:arm64",
+    ],
+    version = "17",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk20_linux}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "20",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk20_linux_aarch64}
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:aarch64",
+    ],
+    version = "20",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk20_macos}
+    target_compatible_with = [
+        "@platforms//os:macos",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "20",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk20_macos_aarch64}
+    target_compatible_with = [
+        "@platforms//os:macos",
+        "@platforms//cpu:aarch64",
+    ],
+    version = "20",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+maybe(
+    remote_java_repository,
+    {remotejdk20_win}
+    target_compatible_with = [
+        "@platforms//os:windows",
+        "@platforms//cpu:x86_64",
+    ],
+    version = "20",
+)
+
+maybe(
+    http_archive,
+{remote_java_tools}
+)
+
+maybe(
+    http_archive,
+{remote_java_tools_linux}
+)
+
+maybe(
+    http_archive,
+{remote_java_tools_windows}
+)
+
+maybe(
+    http_archive,
+{remote_java_tools_darwin_x86_64}
+)
+
+maybe(
+    http_archive,
+{remote_java_tools_darwin_arm64}
+)
 
 maybe(
     http_archive,
@@ -25,6 +285,4 @@ maybe(
 {rules_python}
 )
 
-load("@rules_java//java:repositories.bzl", "rules_java_dependencies", "rules_java_toolchains")
-rules_java_dependencies()
-rules_java_toolchains()
+register_toolchains("@bazel_tools//tools/jdk:all")
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoader.java b/src/main/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoader.java
index f1f056c188dabd..9315a19f988e0d 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoader.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoader.java
@@ -16,7 +16,6 @@
 import com.google.common.base.Suppliers;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
 import com.google.devtools.build.lib.analysis.ConfiguredRuleClassProvider;
 import com.google.devtools.build.lib.bazel.BazelRepositoryModule;
 import com.google.devtools.build.lib.bazel.repository.cache.RepositoryCache;
@@ -27,7 +26,6 @@
 import com.google.devtools.build.lib.packages.BuildFileName;
 import com.google.devtools.build.lib.repository.ExternalPackageHelper;
 import com.google.devtools.build.lib.rules.repository.RepositoryDelegatorFunction;
-import com.google.devtools.build.lib.rules.repository.ResolvedHashesFunction;
 import com.google.devtools.build.lib.skyframe.ActionEnvironmentFunction;
 import com.google.devtools.build.lib.skyframe.BazelSkyframeExecutorConstants;
 import com.google.devtools.build.lib.skyframe.ClientEnvironmentFunction;
@@ -100,11 +98,7 @@ private Builder(Root workspaceDir, Path installBase, Path outputBase, AtomicBool
               RepositoryDelegatorFunction.RESOLVED_FILE_INSTEAD_OF_WORKSPACE, Optional.empty()),
           PrecomputedValue.injected(
               RepositoryDelegatorFunction.DEPENDENCY_FOR_UNCONDITIONAL_FETCHING,
-              RepositoryDelegatorFunction.DONT_FETCH_UNCONDITIONALLY),
-          PrecomputedValue.injected(
-              RepositoryDelegatorFunction.OUTPUT_VERIFICATION_REPOSITORY_RULES, ImmutableSet.of()),
-          PrecomputedValue.injected(
-              RepositoryDelegatorFunction.RESOLVED_FILE_FOR_VERIFICATION, Optional.empty()));
+              RepositoryDelegatorFunction.DONT_FETCH_UNCONDITIONALLY));
     }
 
     @Override
@@ -135,7 +129,6 @@ public BazelPackageLoader buildImpl() {
                       ImmutableMap::of,
                       directories,
                       EXTERNAL_PACKAGE_HELPER))
-              .put(SkyFunctions.RESOLVED_HASH_VALUES, new ResolvedHashesFunction())
               .build());
 
       return new BazelPackageLoader(this);
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/mock/BUILD b/src/test/java/com/google/devtools/build/lib/analysis/mock/BUILD
index ccba50576a40b0..322734c8e8f45c 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/mock/BUILD
+++ b/src/test/java/com/google/devtools/build/lib/analysis/mock/BUILD
@@ -20,7 +20,6 @@ java_library(
     ]),
     data = [
         "//tools/jdk:srcs",
-        "@rules_java//toolchains:srcs",
     ],
     resources = [
         "cc_toolchain_config.bzl",
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/mock/BazelAnalysisMock.java b/src/test/java/com/google/devtools/build/lib/analysis/mock/BazelAnalysisMock.java
index fafd440d2cc627..8d9297b920fdd6 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/mock/BazelAnalysisMock.java
+++ b/src/test/java/com/google/devtools/build/lib/analysis/mock/BazelAnalysisMock.java
@@ -412,16 +412,7 @@ public void setupMockClient(MockToolsConfig config, List<String> workspaceConten
     config.create("embedded_tools/objcproto/well_known_type.proto");
 
     config.create("rules_java_workspace/WORKSPACE", "workspace(name = 'rules_java')");
-    config.create("rules_java_workspace/MODULE.bazel", "module(name = 'rules_java')");
     config.create("rules_java_workspace/java/BUILD");
-    config.create("rules_java_workspace/toolchains/BUILD");
-    java.nio.file.Path path =
-        Paths.get(runfiles.rlocation("rules_java/toolchains/java_toolchain_alias.bzl"));
-    if (Files.exists(path)) {
-      config.create(
-          "rules_java_workspace/toolchains/java_toolchain_alias.bzl",
-          MoreFiles.asCharSource(path, UTF_8).read());
-    }
     config.create(
         "rules_java_workspace/java/defs.bzl",
         "def java_binary(**attrs):",
@@ -624,12 +615,6 @@ protected ImmutableMap<String, NonRegistryOverride> getBuiltinModules(
             directories
                 .getEmbeddedBinariesRoot()
                 .getRelative("platforms_workspace")
-                .getPathString()),
-        "rules_java",
-        LocalPathOverride.create(
-            directories
-                .getEmbeddedBinariesRoot()
-                .getRelative("rules_java_workspace")
                 .getPathString()));
   }
 
diff --git a/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java b/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java
index aa2afe05c13676..5fc1745fd2c631 100644
--- a/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java
+++ b/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java
@@ -1592,11 +1592,6 @@ private void useReducedSetOfRules() throws Exception {
     helper.writeFile(
         "/workspace/platforms_workspace/MODULE.bazel",
         "module(name = \"platforms\", version = \"\")");
-    helper.writeFile("/workspace/rules_java_workspace/BUILD");
-    helper.writeFile("/workspace/rules_java_workspace/WORKSPACE");
-    helper.writeFile(
-        "/workspace/rules_java_workspace/MODULE.bazel",
-        "module(name = \"rules_java\", version = \"\")");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoaderTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoaderTest.java
index 431c8a8b0f1294..a00664fd5cb33c 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoaderTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/packages/BazelPackageLoaderTest.java
@@ -55,7 +55,6 @@ public final class BazelPackageLoaderTest extends AbstractPackageLoaderTest {
 
   private Path installBase;
   private Path outputBase;
-  private Path rulesJavaWorkspace;
 
   @Before
   public void setUp() throws Exception {
@@ -68,31 +67,6 @@ public void setUp() throws Exception {
 
     mockEmbeddedTools(embeddedBinaries);
     fetchExternalRepo(RepositoryName.create("bazel_tools"));
-
-    rulesJavaWorkspace = fs.getPath("/rules_java_workspace/");
-    mockRulesJava(rulesJavaWorkspace);
-    createWorkspaceFile("");
-    fetchExternalRepo(RepositoryName.create("rules_java"));
-  }
-
-  private String getDefaultWorkspaceContent() {
-    return "local_repository(name = 'rules_java', path = '" + rulesJavaWorkspace + "')";
-  }
-
-  private void createWorkspaceFile(String content) throws Exception {
-    file("WORKSPACE", getDefaultWorkspaceContent(), content);
-  }
-
-  private static void mockRulesJava(Path rulesJavaWorkspace) throws IOException {
-    rulesJavaWorkspace.getRelative("java").createDirectoryAndParents();
-    FileSystemUtils.writeIsoLatin1(rulesJavaWorkspace.getRelative("WORKSPACE"), "");
-    FileSystemUtils.writeIsoLatin1(rulesJavaWorkspace.getRelative("java/BUILD"), "");
-    FileSystemUtils.writeIsoLatin1(
-        rulesJavaWorkspace.getRelative("java/repositories.bzl"),
-        "def rules_java_dependencies():",
-        "    pass",
-        "def rules_java_toolchains():",
-        "    pass");
   }
 
   private static void mockEmbeddedTools(Path embeddedBinaries) throws IOException {
@@ -170,7 +144,7 @@ protected ForkJoinPool extractLegacyGlobbingForkJoinPool(PackageLoader packageLo
 
   @Test
   public void simpleLocalRepositoryPackage() throws Exception {
-    createWorkspaceFile("local_repository(name = 'r', path='r')");
+    file("WORKSPACE", "local_repository(name = 'r', path='r')");
     file("r/WORKSPACE", "workspace(name = 'r')");
     file("r/good/BUILD", "sh_library(name = 'good')");
     RepositoryName rRepoName = RepositoryName.create("r");
@@ -189,7 +163,8 @@ public void simpleLocalRepositoryPackage() throws Exception {
 
   @Test
   public void newLocalRepository() throws Exception {
-    createWorkspaceFile(
+    file(
+        "WORKSPACE",
         "new_local_repository(name = 'r', path = '/r', "
             + "build_file_content = 'sh_library(name = \"good\")')");
     fs.getPath("/r").createDirectoryAndParents();
diff --git a/src/test/py/bazel/test_base.py b/src/test/py/bazel/test_base.py
index 4522d748391761..878d5dc746ad85 100644
--- a/src/test/py/bazel/test_base.py
+++ b/src/test/py/bazel/test_base.py
@@ -53,50 +53,36 @@ class TestBase(unittest.TestCase):
   _worker_proc = None
   _cas_path = None
 
-  # Keep in sync with shared repos in src/test/shell/testenv.sh.tmpl
   _SHARED_REPOS = (
-      'android_tools_for_testing',
-      'android_gmaven_r8',
-      'bazel_skylib',
-      'bazel_toolchains',
-      'com_google_protobuf',
-      'openjdk_linux_aarch64_vanilla',
-      'openjdk_linux_vanilla',
-      'openjdk_macos_x86_64_vanilla',
-      'openjdk_macos_aarch64_vanilla',
-      'openjdk_win_vanilla',
-      'remote_coverage_tools',
-      'remote_java_tools',
-      'remote_java_tools_darwin_x86_64',
-      'remote_java_tools_darwin_arm64',
-      'remote_java_tools_linux',
-      'remote_java_tools_windows',
-      'remotejdk11_linux',
-      'remotejdk11_linux_aarch64',
-      'remotejdk11_linux_ppc64le',
-      'remotejdk11_linux_s390x',
-      'remotejdk11_macos',
-      'remotejdk11_macos_aarch64',
-      'remotejdk11_win',
-      'remotejdk11_win_arm64',
-      'remotejdk17_linux',
-      'remotejdk17_linux_s390x',
-      'remotejdk17_macos',
-      'remotejdk17_macos_aarch64',
-      'remotejdk17_win',
-      'remotejdk17_win_arm64',
-      'remotejdk20_linux',
-      'remotejdk20_macos',
-      'remotejdk20_macos_aarch64',
-      'remotejdk20_win',
-      'remotejdk20_win_arm64',
+      'rules_license',
       'rules_cc',
       'rules_java',
-      'rules_license',
       'rules_proto',
       'rules_python',
-      'rules_pkg',
-      'rules_testing',
+      'remotejdk11_linux_for_testing',
+      'remotejdk11_linux_aarch64_for_testing',
+      'remotejdk11_linux_ppc64le_for_testing',
+      'remotejdk11_linux_s390x_for_testing',
+      'remotejdk11_macos_for_testing',
+      'remotejdk11_macos_aarch64_for_testing',
+      'remotejdk11_win_for_testing',
+      'remotejdk11_win_arm64_for_testing',
+      'remotejdk17_linux_for_testing',
+      'remotejdk17_linux_s390x_for_testing',
+      'remotejdk17_macos_for_testing',
+      'remotejdk17_macos_aarch64_for_testing',
+      'remotejdk17_win_for_testing',
+      'remotejdk17_win_arm64_for_testing',
+      'remotejdk20_linux_for_testing',
+      'remotejdk20_macos_for_testing',
+      'remotejdk20_macos_aarch64_for_testing',
+      'remotejdk20_win_for_testing',
+      'remote_java_tools_for_testing',
+      'remote_java_tools_darwin_x86_64_for_testing',
+      'remote_java_tools_darwin_arm64_for_testing',
+      'remote_java_tools_linux_for_testing',
+      'remote_java_tools_windows_for_testing',
+      'remote_coverage_tools',
   )
 
   def setUp(self):
diff --git a/src/test/shell/bazel/BUILD b/src/test/shell/bazel/BUILD
index 9dd7a46db02047..fc6a335ea5671d 100644
--- a/src/test/shell/bazel/BUILD
+++ b/src/test/shell/bazel/BUILD
@@ -230,6 +230,7 @@ sh_test(
         ":test-deps",
         "//src:java_tools_prebuilt_zip",
         "//src:java_tools_zip",
+        "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
         "@bazel_tools//tools/bash/runfiles",
     ],
     tags = ["local"],
@@ -247,6 +248,7 @@ sh_test(
     ],
     data = [
         ":test-deps",
+        "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
         "@bazel_tools//tools/bash/runfiles",
     ],
     exec_compatible_with = ["//:highcpu_machine"],
@@ -275,6 +277,7 @@ JAVA_VERSIONS_COVERAGE = ("11", "17")
             ":test-deps",
             "//src:java_tools_prebuilt_zip",
             "//src:java_tools_zip",
+            "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
             "@bazel_tools//tools/bash/runfiles",
         ],
         exec_compatible_with = ["//:highcpu_machine"],
@@ -299,6 +302,7 @@ JAVA_VERSIONS_COVERAGE = ("11", "17")
         ],
         data = [
             ":test-deps",
+            "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
             "@bazel_tools//tools/bash/runfiles",
         ],
         # This test is only run by the java_tools binaries pipeline.
@@ -484,6 +488,7 @@ sh_test(
     ],
     data = [
         ":test-deps",
+        "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
     ],
     tags = [
         "no_windows",
@@ -507,6 +512,7 @@ sh_test(
         ],
         data = [
             ":test-deps",
+            "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
         ],
         tags = [
             "no_windows",
@@ -534,6 +540,7 @@ sh_test(
             ":test-deps",
             "//src:java_tools_prebuilt_zip",
             "//src:java_tools_zip",
+            "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
             "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo",
         ],
         tags = ["no_windows"],
@@ -932,13 +939,20 @@ sh_test(
     tags = ["no_windows"],
 )
 
+filegroup(
+    name = "test_WORKSPACE",
+    srcs = [
+        "@test_WORKSPACE_files//:archives",
+    ],
+)
+
 sh_test(
     name = "workspace_resolved_test",
     size = "large",
     srcs = ["workspace_resolved_test.sh"],
     data = [
         ":test-deps",
-        "@bazel_tools//tools/bash/runfiles",
+        ":test_WORKSPACE",
     ],
     shard_count = 22,
     tags = [
diff --git a/src/test/shell/bazel/bazel_coverage_java_test.sh b/src/test/shell/bazel/bazel_coverage_java_test.sh
index 1b3826542533cf..8a110aed4645c7 100755
--- a/src/test/shell/bazel/bazel_coverage_java_test.sh
+++ b/src/test/shell/bazel/bazel_coverage_java_test.sh
@@ -90,6 +90,8 @@ http_archive(
 )
 EOF
     fi
+
+    cat $(rlocation io_bazel/src/test/shell/bazel/testdata/jdk_http_archives) >> WORKSPACE
 }
 
 # Returns 0 if gcov is not installed or if a version before 7.0 was found.
diff --git a/src/test/shell/bazel/bazel_java17_test.sh b/src/test/shell/bazel/bazel_java17_test.sh
index 2e9b889f1b8365..7b7d1c7852bab7 100755
--- a/src/test/shell/bazel/bazel_java17_test.sh
+++ b/src/test/shell/bazel/bazel_java17_test.sh
@@ -99,6 +99,7 @@ http_archive(
     urls = ["${JAVA_TOOLS_PREBUILT_ZIP_FILE_URL}"]
 )
 EOF
+    cat $(rlocation io_bazel/src/test/shell/bazel/testdata/jdk_http_archives) >> WORKSPACE
 }
 
 # Java source files version shall match --java_language_version_flag version.
diff --git a/src/test/shell/bazel/bazel_java_test.sh b/src/test/shell/bazel/bazel_java_test.sh
index 88786c32d63d7b..8ac7bfefb3619e 100755
--- a/src/test/shell/bazel/bazel_java_test.sh
+++ b/src/test/shell/bazel/bazel_java_test.sh
@@ -141,6 +141,8 @@ http_archive(
 )
 EOF
   fi
+
+  cat $(rlocation io_bazel/src/test/shell/bazel/testdata/jdk_http_archives) >> WORKSPACE
 }
 
 function tear_down() {
diff --git a/src/test/shell/bazel/bazel_package_loader_test.sh b/src/test/shell/bazel/bazel_package_loader_test.sh
index 460f085291c5f3..a81c7c0e3cd0a5 100755
--- a/src/test/shell/bazel/bazel_package_loader_test.sh
+++ b/src/test/shell/bazel/bazel_package_loader_test.sh
@@ -21,7 +21,6 @@ source "${CURRENT_DIR}/../integration_test_setup.sh"
 
 TESTER="$(rlocation io_bazel/src/main/java/com/google/devtools/build/lib/skyframe/packages/testing/BazelPackageLoaderTester)"
 
-mock_rules_java_to_avoid_downloading
 
 function test_bazel_package_loader() {
   install_base="$(bazel info install_base)"
@@ -35,15 +34,6 @@ EOF
 sh_library(name = 'x')
 sh_library(name = 'y')
 sh_library(name = 'z')
-EOF
-
-  # Override rules_java in WORKSPACE
-  rules_java_workspace="${TEST_TMPDIR}/rules_java_workspace"
-  cat > WORKSPACE <<EOF
-local_repository(
-    name = "rules_java",
-    path = "${rules_java_workspace}",
-)
 EOF
 
   "$TESTER" "$install_base" foo bar >& "$TEST_log"
diff --git a/src/test/shell/bazel/bazel_rules_java_test.sh b/src/test/shell/bazel/bazel_rules_java_test.sh
index 3858780c974c59..abde0bbd107276 100755
--- a/src/test/shell/bazel/bazel_rules_java_test.sh
+++ b/src/test/shell/bazel/bazel_rules_java_test.sh
@@ -71,17 +71,10 @@ local_repository(
 )
 EOF
 
-  mkdir -p override/java || fail "couldn't create override directory"
+  mkdir -p override || fail "couldn't create override directory"
   touch override/WORKSPACE || fail "couldn't touch override/WORKSPACE"
   cat > override/BUILD <<EOF
 filegroup(name = 'yolo')
-EOF
-  touch override/java/BUILD || fail "couldn't touch override/java/BUILD"
-  cat > override/java/repositories.bzl <<EOF
-def rules_java_dependencies():
-    pass
-def rules_java_toolchains():
-    pass
 EOF
 
   cd rules_java_can_be_overridden || fail "couldn't cd into workspace"
diff --git a/src/test/shell/bazel/bazel_workspaces_test.sh b/src/test/shell/bazel/bazel_workspaces_test.sh
index a33b443f17c143..a0669133572c25 100755
--- a/src/test/shell/bazel/bazel_workspaces_test.sh
+++ b/src/test/shell/bazel/bazel_workspaces_test.sh
@@ -23,8 +23,6 @@ source "${CURRENT_DIR}/../integration_test_setup.sh" \
 source "${CURRENT_DIR}/remote_helpers.sh" \
   || { echo "remote_helpers.sh not found!" >&2; exit 1; }
 
-mock_rules_java_to_avoid_downloading
-
 # Sets up a workspace with the given commands inserted into the repository rule
 # that will be executed when doing bazel build //:test
 function set_workspace_command() {
diff --git a/src/test/shell/bazel/remote/BUILD b/src/test/shell/bazel/remote/BUILD
index 53852dfb698e02..8a50297b96954a 100644
--- a/src/test/shell/bazel/remote/BUILD
+++ b/src/test/shell/bazel/remote/BUILD
@@ -25,6 +25,7 @@ sh_test(
         ":remote_utils",
         ":uds_proxy.py",
         "//src/test/shell/bazel:test-deps",
+        "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
         "//src/tools/remote:worker",
         "@bazel_tools//tools/bash/runfiles",
     ],
@@ -39,6 +40,7 @@ sh_test(
     data = [
         ":remote_utils",
         "//src/test/shell/bazel:test-deps",
+        "//src/test/shell/bazel/testdata:jdk_http_archives_filegroup",
         "//src/tools/remote:worker",
         "@bazel_tools//tools/bash/runfiles",
     ],
diff --git a/src/test/shell/bazel/remote/build_without_the_bytes_test.sh b/src/test/shell/bazel/remote/build_without_the_bytes_test.sh
index 7d3ecbf7c98930..199b09e99d3181 100755
--- a/src/test/shell/bazel/remote/build_without_the_bytes_test.sh
+++ b/src/test/shell/bazel/remote/build_without_the_bytes_test.sh
@@ -1693,6 +1693,8 @@ public class FactorialTest {
 EOF
   cd ../..
 
+  cat $(rlocation io_bazel/src/test/shell/bazel/testdata/jdk_http_archives) >> WORKSPACE
+
   bazel coverage \
     --test_output=all \
     --experimental_fetch_all_coverage_outputs \
diff --git a/src/test/shell/bazel/remote/remote_execution_test.sh b/src/test/shell/bazel/remote/remote_execution_test.sh
index 10ec8d80feb919..0945e101a0c3bb 100755
--- a/src/test/shell/bazel/remote/remote_execution_test.sh
+++ b/src/test/shell/bazel/remote/remote_execution_test.sh
@@ -2101,6 +2101,8 @@ public class FactorialTest {
 EOF
   cd ../..
 
+  cat $(rlocation io_bazel/src/test/shell/bazel/testdata/jdk_http_archives) >> WORKSPACE
+
   bazel coverage \
     --test_output=all \
     --experimental_fetch_all_coverage_outputs \
diff --git a/src/test/shell/bazel/starlark_repository_test.sh b/src/test/shell/bazel/starlark_repository_test.sh
index cbf8f186311b2d..e6242b74f42759 100755
--- a/src/test/shell/bazel/starlark_repository_test.sh
+++ b/src/test/shell/bazel/starlark_repository_test.sh
@@ -68,8 +68,6 @@ fi
 source "$(rlocation "io_bazel/src/test/shell/bazel/remote_helpers.sh")" \
   || { echo "remote_helpers.sh not found!" >&2; exit 1; }
 
-mock_rules_java_to_avoid_downloading
-
 # Basic test.
 function test_macro_local_repository() {
   create_new_workspace
diff --git a/src/test/shell/bazel/testdata/BUILD b/src/test/shell/bazel/testdata/BUILD
index 39388dd0c4a12b..36825fe293277c 100644
--- a/src/test/shell/bazel/testdata/BUILD
+++ b/src/test/shell/bazel/testdata/BUILD
@@ -1,3 +1,5 @@
+load("//:distdir_deps.bzl", "gen_workspace_stanza")
+
 package(default_testonly = True)
 
 filegroup(
@@ -26,4 +28,42 @@ filegroup(
     visibility = ["//src/test/shell/bazel:__pkg__"],
 )
 
+filegroup(
+    name = "jdk_http_archives_filegroup",
+    srcs = [
+        "//src/test/shell/bazel/testdata:jdk_http_archives",
+    ],
+    visibility = ["//src/test/shell/bazel:__subpackages__"],
+)
+
+gen_workspace_stanza(
+    name = "workspace_with_rules_java",
+    out = "jdk_http_archives",
+    repo_clause = """
+  name = "{repo}",
+  sha256 = "{sha256}",
+  strip_prefix = {strip_prefix},
+  urls = {urls},
+""",
+    repos = [
+        "remote_java_tools_test",
+        "remote_java_tools_test_linux",
+        "remote_java_tools_test_windows",
+        "remote_java_tools_test_darwin_x86_64",
+        "remote_java_tools_test_darwin_arm64",
+        "openjdk11_linux_archive",
+        "openjdk11_linux_s390x_archive",
+        "openjdk11_darwin_archive",
+        "openjdk11_darwin_aarch64_archive",
+        "openjdk11_windows_archive",
+        "openjdk11_windows_arm64_archive",
+    ] + [
+        "openjdk%s_%s_archive" % (version, os)
+        for version in ("17", "20")
+        for os in ("linux", "darwin", "darwin_aarch64", "windows") + (("linux_s390x", "windows_arm64") if version != "20" else ())
+    ],
+    template = "jdk_http_archives.tmpl",
+    visibility = ["//:__pkg__"],
+)
+
 exports_files(["zstd_test_archive.tar.zst"])
diff --git a/src/test/shell/bazel/testdata/jdk_http_archives.tmpl b/src/test/shell/bazel/testdata/jdk_http_archives.tmpl
new file mode 100644
index 00000000000000..d3847bb2618409
--- /dev/null
+++ b/src/test/shell/bazel/testdata/jdk_http_archives.tmpl
@@ -0,0 +1,145 @@
+################### Remote java_tools with embedded javac 11 ###################
+http_archive(
+    {remote_java_tools_test}
+)
+
+http_archive(
+    {remote_java_tools_test_linux}
+)
+
+http_archive(
+    {remote_java_tools_test_windows}
+)
+
+http_archive(
+    {remote_java_tools_test_darwin_x86_64}
+)
+
+http_archive(
+    {remote_java_tools_test_darwin_arm64}
+)
+
+#################################### JDK 11 ####################################
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk11_linux_archive}
+    build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk11_linux_s390x_archive}
+    build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk11_darwin_archive}
+    build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk11_darwin_aarch64_archive}
+    build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk11_windows_archive}
+    build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk11_windows_arm64_archive}
+    build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+)
+
+#################################### JDK 17 ####################################
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk17_linux_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with the top-level WORKSPACE file.
+http_archive(
+    {openjdk17_linux_s390x_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+http_archive(
+    {openjdk17_darwin_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+http_archive(
+    {openjdk17_darwin_aarch64_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+http_archive(
+    {openjdk17_windows_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+# This must be kept in sync with src/test/shell/bazel/testdata/jdk_http_archives.
+http_archive(
+    {openjdk17_windows_arm64_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+#################################### JDK 20 ####################################
+http_archive(
+    {openjdk20_linux_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+http_archive(
+    {openjdk20_darwin_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+http_archive(
+    {openjdk20_darwin_aarch64_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
+
+http_archive(
+    {openjdk20_windows_archive}
+    build_file_content = """
+java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])
+exports_files(["WORKSPACE"], visibility = ["//visibility:public"])
+""",
+)
diff --git a/src/test/shell/bazel/workspace_resolved_test.sh b/src/test/shell/bazel/workspace_resolved_test.sh
index 66ee308eca4243..d9a7e6fa7c7024 100755
--- a/src/test/shell/bazel/workspace_resolved_test.sh
+++ b/src/test/shell/bazel/workspace_resolved_test.sh
@@ -19,8 +19,6 @@ CURRENT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${CURRENT_DIR}/../integration_test_setup.sh" \
   || { echo "integration_test_setup.sh not found!" >&2; exit 1; }
 
-mock_rules_java_to_avoid_downloading
-
 test_result_recorded() {
   mkdir result_recorded && cd result_recorded
   rm -rf fetchrepo
@@ -101,6 +99,7 @@ EOF
 
 test_git_return_value() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   export GIT_CONFIG_NOSYSTEM=YES
 
@@ -129,7 +128,7 @@ new_git_repository(
 EOF
 
 
-  bazel sync --experimental_repository_resolved_file=../repo.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=../repo.bzl
   bazel shutdown
 
   cd ..
@@ -178,6 +177,7 @@ EOF
 
 test_git_follow_branch() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   export GIT_CONFIG_NOSYSTEM=YES
 
@@ -210,7 +210,7 @@ genrule(
   cmd = "cp $< $@",
 )
 EOF
-  bazel sync --experimental_repository_resolved_file=../repo.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=../repo.bzl
   bazel build :out
   grep "CHANGED" `bazel info bazel-genfiles`/out.txt  \
        && fail "Unexpected content in out.txt" || :
@@ -226,7 +226,7 @@ EOF
 
   # First verify that `bazel sync` sees the new commit (we don't record it).
   cd branchcheckout
-  bazel sync
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir
   bazel build :out
   grep "CHANGED" `bazel info bazel-genfiles`/out.txt  \
        || fail "sync did not update the external repository"
@@ -269,6 +269,7 @@ EOF
 
 test_sync_follows_git_branch() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   export GIT_CONFIG_NOSYSTEM=YES
 
@@ -318,7 +319,7 @@ EOF
    git commit --author="A U Thor <author@example.com>" -m 'stable commit')
 
   # Verify that sync followed by build gets the correct version
-  (cd followbranch && bazel sync && bazel build :out \
+  (cd followbranch && bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir && bazel build :out \
        && cat `bazel info bazel-genfiles`/out.txt > "${TEST_log}")
   expect_log 'CHANGED'
   expect_not_log 'Hello Stable World'
@@ -326,6 +327,7 @@ EOF
 
 test_http_return_value() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir -p a
   touch a/WORKSPACE
@@ -350,7 +352,7 @@ EOF
   touch main/BUILD
 
   cd main
-  bazel sync \
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
       --experimental_repository_resolved_file=../repo.bzl
 
   grep ${expected_sha256} ../repo.bzl || fail "didn't return commit"
@@ -358,6 +360,7 @@ EOF
 
 test_sync_calls_all() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir sync_calls_all && cd sync_calls_all
   rm -rf fetchrepo
@@ -390,7 +393,7 @@ trivial_rule(name = "d", comment = other)
 EOF
 
   bazel clean --expunge
-  bazel sync --experimental_repository_resolved_file=../repo.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=../repo.bzl
   bazel shutdown
 
   cd ..
@@ -416,6 +419,7 @@ EOF
 
 test_sync_call_invalidates() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir sync_call_invalidates && cd sync_call_invalidates
   rm -rf fetchrepo
@@ -447,7 +451,7 @@ EOF
 
   bazel build @a//... @b//...
   echo; echo sync run; echo
-  bazel sync --experimental_repository_resolved_file=../repo.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=../repo.bzl
   bazel shutdown
 
   cd ..
@@ -472,6 +476,7 @@ EOF
 
 test_sync_load_errors_reported() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   rm -rf fetchrepo
   mkdir fetchrepo
@@ -481,7 +486,7 @@ load("//does/not:exist.bzl", "randomfunction")
 
 radomfunction(name="foo")
 EOF
-  bazel sync > "${TEST_log}" 2>&1 && fail "Expected failure" || :
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir > "${TEST_log}" 2>&1 && fail "Expected failure" || :
   expect_log '//does/not:exist.bzl'
 }
 
@@ -489,6 +494,7 @@ test_sync_reporting() {
   # Verify that debug and error messages in starlark functions are reported.
   # Also verify that the fact that the repository is fetched is reported as well.
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   rm -rf fetchrepo
   mkdir fetchrepo
@@ -509,7 +515,7 @@ load("//:rule.bzl", "broken_rule")
 
 broken_rule(name = "broken")
 EOF
-  bazel sync --curses=yes --experimental_ui_actions_shown=100 > "${TEST_log}" 2>&1 && fail "expected failure" || :
+  bazel sync --curses=yes --experimental_ui_actions_shown=100 --distdir=${EXTREPODIR}/test_WORKSPACE/distdir > "${TEST_log}" 2>&1 && fail "expected failure" || :
   expect_log 'Fetching repository @broken'
   expect_log "DEBUG-message"
   expect_log "Failure-message"
@@ -517,6 +523,7 @@ EOF
 
 test_indirect_call() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   rm -rf fetchrepo
   mkdir fetchrepo
@@ -541,7 +548,7 @@ load("//:indirect.bzl", "call")
 
 call(trivial_rule, name="foo")
 EOF
-  bazel sync --experimental_repository_resolved_file=../repo.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=../repo.bzl
   bazel shutdown
 
   cd ..
@@ -569,6 +576,7 @@ test_resolved_file_reading() {
   # file works as expected.
   EXTREPODIR=`pwd`
   export GIT_CONFIG_NOSYSTEM=YES
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir extgit
   (cd extgit && git init \
@@ -599,7 +607,7 @@ genrule(
   cmd = "cp $< $@",
 )
 EOF
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=resolved.bzl
   echo; cat resolved.bzl; echo
 
   bazel clean --expunge
@@ -616,6 +624,7 @@ test_label_resolved_value() {
   # Verify that label arguments in a repository rule end up in the resolved
   # file in a parsable form.
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
   mkdir ext
   echo Hello World > ext/file.txt
   zip ext.zip ext/*
@@ -641,7 +650,7 @@ genrule(
 )
 EOF
 
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=resolved.bzl
   rm WORKSPACE
   touch WORKSPACE
   echo; cat resolved.bzl; echo
@@ -656,6 +665,7 @@ test_resolved_file_not_remembered() {
   # Verify that the --experimental_resolved_file_instead_of_workspace option
   # does not leak into a subsequent sync
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   export GIT_CONFIG_NOSYSTEM=YES
 
@@ -690,7 +700,7 @@ genrule(
 )
 EOF
   (cd followbranch \
-    && bazel sync --experimental_repository_resolved_file=resolved.bzl)
+    && bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=resolved.bzl)
   # New upstream commits on the branch followed
   echo CHANGED > gitdir/hello.txt
   (cd gitdir
@@ -703,7 +713,7 @@ EOF
   cat `bazel info bazel-genfiles`/out.txt > "${TEST_log}"
   expect_log 'Hello Stable World'
   expect_not_log 'CHANGED'
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=resolved.bzl
   bazel build --experimental_resolved_file_instead_of_workspace=resolved.bzl :out
   cat `bazel info bazel-genfiles`/out.txt > "${TEST_log}"
   expect_log 'CHANGED'
@@ -744,12 +754,13 @@ test_hash_included_and_reproducible() {
   # - change of the working directory, and
   # - and current time.
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   rm -rf fetchrepoA
   mkdir fetchrepoA
   cd fetchrepoA
   create_sample_repository
-  bazel sync --experimental_repository_resolved_file=../repo.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=../repo.bzl
   bazel shutdown
 
   cd ..
@@ -779,7 +790,7 @@ EOF
   mkdir fetchrepoB
   cd fetchrepoB
   create_sample_repository
-  bazel sync --experimental_repository_resolved_file=../repo.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=../repo.bzl
   bazel shutdown
 
   cd ..
@@ -792,6 +803,7 @@ EOF
 
 test_non_reproducibility_detected() {
     EXTREPODIR=`pwd`
+    tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
     # Verify that a non-reproducible rule is detected by hash verification
     mkdir repo
     cd repo
@@ -811,9 +823,9 @@ load("//:rule.bzl", "time_rule")
 time_rule(name="timestamprepo")
 EOF
 
-    bazel sync --experimental_repository_resolved_file=resolved.bzl
+    bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=resolved.bzl
     cat resolved.bzl > /dev/null || fail "resolved.bzl should exist"
-    bazel sync --experimental_repository_hash_file=`pwd`/resolved.bzl \
+    bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_hash_file=`pwd`/resolved.bzl \
           --experimental_verify_repository_rules='//:rule.bzl%time_rule' \
           > "${TEST_log}" 2>&1 && fail "expected failure" || :
     expect_log "timestamprepo.*hash"
@@ -823,6 +835,7 @@ test_chain_resolved() {
   # Verify that a cahin of dependencies in external repositories is reflected
   # in the resolved file in such a way, that the resolved file can be used.
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir rulerepo
   cat > rulerepo/rule.bzl <<'EOF'
@@ -857,7 +870,8 @@ genrule(
   cmd = "cp $< $@",
 )
 EOF
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
+        --experimental_repository_resolved_file=resolved.bzl
   bazel clean --expunge
   echo; cat resolved.bzl; echo
 
@@ -870,6 +884,7 @@ test_usage_order_respected() {
    # statement between), then still the resolved file is such that it can
    # be used as a workspace replacement.
    EXTREPODIR=`pwd`
+   tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
    mkdir datarepo
    echo 'Pure data' > datarepo/data.txt
@@ -906,7 +921,7 @@ genrule(
   cmd = "cp $< $@",
 )
 EOF
-  bazel sync \
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
      --experimental_repository_resolved_file=resolved.bzl
   bazel clean --expunge
   echo; cat resolved.bzl; echo
@@ -920,6 +935,7 @@ test_order_reproducible() {
   # Verify that the order of repositories in the resolved file is reproducible
   # and does not depend on the parameters or timing of the actual rules.
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir main
   cd main
@@ -952,7 +968,7 @@ sleep_rule(name="a", sleep=1)
 sleep_rule(name="c", sleep=3)
 sleep_rule(name="b", sleep=5)
 EOF
-  bazel sync \
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
         --experimental_repository_resolved_file=repo.bzl
   bazel build //:order
   cp `bazel info bazel-genfiles`/order.txt order-first.txt
@@ -965,7 +981,7 @@ sleep_rule(name="a", sleep=5)
 sleep_rule(name="c", sleep=3)
 sleep_rule(name="b", sleep=1)
 EOF
-  bazel sync \
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
         --experimental_repository_resolved_file=repo.bzl
   bazel build //:order
   cp `bazel info bazel-genfiles`/order.txt order-second.txt
@@ -980,6 +996,7 @@ test_non_starlarkrepo() {
   # Verify that entries in the WORKSPACE that are not starlark repositoires
   # are correctly reported in the resolved file.
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir local
   touch local/WORKSPACE
@@ -1012,7 +1029,8 @@ EOF
 
   bazel build //:it || fail "Expected success"
 
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
+        --experimental_repository_resolved_file=resolved.bzl
   echo > WORKSPACE # remove workspace, only work from the resolved file
   bazel clean --expunge
   echo; cat resolved.bzl; echo
@@ -1069,6 +1087,7 @@ test_toolchain_recorded() {
   # Verify that the registration of toolchains and execution platforms is
   # recorded in the resolved file
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir ext
   touch ext/BUILD
@@ -1093,7 +1112,8 @@ load("@ext//:toolchains.bzl", "ext_toolchains")
 ext_toolchains()
 EOF
   touch BUILD
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
+        --experimental_repository_resolved_file=resolved.bzl
   echo; cat resolved.bzl; echo
 
   grep 'register_toolchains.*ext//:toolchain' resolved.bzl \
@@ -1104,6 +1124,7 @@ EOF
 
 test_local_config_platform_recorded() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   # Verify that the auto-generated local_config_platform repo is
   # recorded in the resolved file
@@ -1113,7 +1134,9 @@ test_local_config_platform_recorded() {
   cat >> WORKSPACE <<EOF
 EOF
   touch BUILD
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync \
+      --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
+      --experimental_repository_resolved_file=resolved.bzl
   echo; cat resolved.bzl; echo
 
   grep 'local_config_platform' resolved.bzl \
@@ -1124,6 +1147,7 @@ test_definition_location_recorded() {
   # Verify that for Starlark repositories the location of the definition
   # is recorded in the resolved file.
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir ext
   touch ext/BUILD
@@ -1157,7 +1181,8 @@ load("//:first/path/foo.bzl", "foo")
 foo()
 EOF
 
-  bazel sync --experimental_repository_resolved_file=resolved.bzl
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir \
+        --experimental_repository_resolved_file=resolved.bzl
 
   echo; cat resolved.bzl; echo
 
@@ -1198,6 +1223,7 @@ EOF
 # created attributes (in particular, the generator_* attributes).
 test_canonical_warning() {
   EXTREPODIR=`pwd`
+  tar xvf ${TEST_SRCDIR}/test_WORKSPACE_files/archives.tar
 
   mkdir main
   touch main/BUILD
@@ -1230,7 +1256,7 @@ EOF
   cd main
   # We should get a warning for "myattr" having a changed value and for "name"
   # being dropped, but not for the generator_* attributes.
-  bazel sync >/dev/null 2>$TEST_log
+  bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir >/dev/null 2>$TEST_log
   bazel clean --expunge
   expect_log "Rule 'myrepo' indicated that a canonical reproducible form \
 can be obtained by modifying arguments myattr = \"bar\" and dropping \
diff --git a/src/test/shell/integration/bazel_java_test.sh b/src/test/shell/integration/bazel_java_test.sh
index 1da2564e662297..a689a13b0bb9b3 100755
--- a/src/test/shell/integration/bazel_java_test.sh
+++ b/src/test/shell/integration/bazel_java_test.sh
@@ -284,7 +284,7 @@ EOF
 
 
 function test_genrule() {
-  cat << EOF >> WORKSPACE
+  cat << EOF > WORKSPACE
 load("@bazel_tools//tools/jdk:local_java_repository.bzl", "local_java_repository")
 local_java_repository(
     name = "foo_javabase",
diff --git a/src/test/shell/testenv.sh.tmpl b/src/test/shell/testenv.sh.tmpl
index 88d5e6c796c6c7..97d824ddcd078b 100755
--- a/src/test/shell/testenv.sh.tmpl
+++ b/src/test/shell/testenv.sh.tmpl
@@ -281,31 +281,52 @@ EOF
         "openjdk_macos_x86_64_vanilla"
         "openjdk_macos_aarch64_vanilla"
         "openjdk_win_vanilla"
+        "openjdk11_darwin_archive"
+        "openjdk11_darwin_aarch64_archive"
+        "openjdk11_linux_archive"
+        "openjdk11_linux_s390x_archive"
+        "openjdk11_windows_archive"
+        "openjdk11_windows_arm64_archive"
+        "openjdk17_darwin_archive"
+        "openjdk17_darwin_aarch64_archive"
+        "openjdk17_linux_archive"
+        "openjdk17_linux_s390x_archive"
+        "openjdk17_windows_archive"
+        "openjdk17_windows_arm64_archive"
+        "openjdk20_darwin_archive"
+        "openjdk20_darwin_aarch64_archive"
+        "openjdk20_linux_archive"
+        "openjdk20_windows_archive"
         "remote_coverage_tools"
-        "remote_java_tools"
-        "remote_java_tools_darwin_x86_64"
-        "remote_java_tools_darwin_arm64"
-        "remote_java_tools_linux"
-        "remote_java_tools_windows"
-        "remotejdk11_linux"
-        "remotejdk11_linux_aarch64"
-        "remotejdk11_linux_ppc64le"
-        "remotejdk11_linux_s390x"
-        "remotejdk11_macos"
-        "remotejdk11_macos_aarch64"
-        "remotejdk11_win"
-        "remotejdk11_win_arm64"
-        "remotejdk17_linux"
-        "remotejdk17_linux_s390x"
-        "remotejdk17_macos"
-        "remotejdk17_macos_aarch64"
-        "remotejdk17_win"
-        "remotejdk17_win_arm64"
-        "remotejdk20_linux"
-        "remotejdk20_macos"
-        "remotejdk20_macos_aarch64"
-        "remotejdk20_win"
-        "remotejdk20_win_arm64"
+        "remote_java_tools_for_testing"
+        "remote_java_tools_darwin_x86_64_for_testing"
+        "remote_java_tools_darwin_arm64_for_testing"
+        "remote_java_tools_test"
+        "remote_java_tools_test_darwin_x86_64"
+        "remote_java_tools_test_darwin_arm64"
+        "remote_java_tools_test_linux"
+        "remote_java_tools_test_windows"
+        "remote_java_tools_linux_for_testing"
+        "remote_java_tools_windows_for_testing"
+        "remotejdk11_linux_for_testing"
+        "remotejdk11_linux_aarch64_for_testing"
+        "remotejdk11_linux_ppc64le_for_testing"
+        "remotejdk11_linux_s390x_for_testing"
+        "remotejdk11_macos_for_testing"
+        "remotejdk11_macos_aarch64_for_testing"
+        "remotejdk11_win_for_testing"
+        "remotejdk11_win_arm64_for_testing"
+        "remotejdk17_linux_for_testing"
+        "remotejdk17_linux_s390x_for_testing"
+        "remotejdk17_macos_for_testing"
+        "remotejdk17_macos_aarch64_for_testing"
+        "remotejdk17_win_for_testing"
+        "remotejdk17_win_arm64_for_testing"
+        "remotejdk20_linux_for_testing"
+        "remotejdk20_macos_for_testing"
+        "remotejdk20_macos_aarch64_for_testing"
+        "remotejdk20_win_for_testing"
+        "remotejdk20_win_arm64_for_testing"
         "rules_cc"
         "rules_java"
         "rules_license"
@@ -813,27 +834,3 @@ EOF
     chmod +x tools/python/$PYTHON3_FILENAME
   fi
 }
-
-function mock_rules_java_to_avoid_downloading() {
-  rules_java_workspace="${TEST_TMPDIR}/rules_java_workspace"
-  mkdir -p "${rules_java_workspace}/java"
-  touch "${rules_java_workspace}/WORKSPACE"
-  touch "${rules_java_workspace}/java/BUILD"
-  cat > "${rules_java_workspace}/java/repositories.bzl" <<EOF
-def rules_java_dependencies():
-    pass
-def rules_java_toolchains():
-    pass
-EOF
-  cat > "${rules_java_workspace}/java/defs.bzl" <<EOF
-def java_binary(**attrs):
-    native.java_binary(**attrs)
-def java_library(**attrs):
-    native.java_library(**attrs)
-def java_import(**attrs):
-    native.java_import(**attrs)
-def java_test(**attrs):
-    native.java_test(**attrs)
-EOF
-  add_to_bazelrc "common --override_repository=rules_java=${rules_java_workspace}"
-}
diff --git a/tools/jdk/BUILD b/tools/jdk/BUILD
index f1269cfe386bd4..c6998668444117 100644
--- a/tools/jdk/BUILD
+++ b/tools/jdk/BUILD
@@ -12,8 +12,11 @@ filegroup(
         "BUILD.java_tools",
         "BUILD.java_tools_prebuilt",
         "BUILD-jdk",  # Tools are build from the workspace for tests.
+        "DumpPlatformClassPath.java",
         "default_java_toolchain.bzl",
+        "fail_rule.bzl",
         "java_toolchain_alias.bzl",
+        "jdk_build_file.bzl",
         "local_java_repository.bzl",
         "nosystemjdk/README",
         "proguard_whitelister.py",
diff --git a/tools/jdk/BUILD.tools b/tools/jdk/BUILD.tools
index 5f603d953eaeec..b5f84c835a0ac1 100644
--- a/tools/jdk/BUILD.tools
+++ b/tools/jdk/BUILD.tools
@@ -1,11 +1,22 @@
-package(default_visibility = ["//visibility:public"])
-
+load(
+    "@bazel_tools//tools/jdk:default_java_toolchain.bzl",
+    "DEFAULT_TOOLCHAIN_CONFIGURATION",
+    "PREBUILT_TOOLCHAIN_CONFIGURATION",
+    "VANILLA_TOOLCHAIN_CONFIGURATION",
+    "bootclasspath",
+    "default_java_toolchain",
+    "java_runtime_files",
+)
+load(
+    "//tools/jdk:java_toolchain_alias.bzl",
+    "java_host_runtime_alias",
+    "java_runtime_alias",
+    "java_runtime_version_alias",
+    "java_toolchain_alias",
+)
 load("@rules_python//python:defs.bzl", "py_binary", "py_test")
 
-exports_files([
-    "BUILD.java_tools",
-    "java_stub_template.txt",
-])
+package(default_visibility = ["//visibility:public"])
 
 # Used to distinguish toolchains used for Java development, ie the JavaToolchainProvider.
 toolchain_type(name = "toolchain_type")
@@ -13,11 +24,184 @@ toolchain_type(name = "toolchain_type")
 # Used to distinguish toolchains used for Java execution, ie the JavaRuntimeInfo.
 toolchain_type(name = "runtime_toolchain_type")
 
+# Points to toolchain[":runtime_toolchain_type"] (was :legacy_current_java_runtime)
+java_runtime_alias(name = "current_java_runtime")
+
+# Host configuration of ":current_java_runtime"
+java_host_runtime_alias(name = "current_host_java_runtime")
+
+# Points to toolchain[":toolchain_type"] (was :legacy_current_java_toolchain)
+java_toolchain_alias(name = "current_java_toolchain")
+
 # Aliases value of --plugins flag as a JavaPluginInfo
 java_plugins_flag_alias(
     name = "java_plugins_flag_alias",
 )
 
+# This is necessary to get the *host* Java runtime. Depending on
+# //tools/jdk:current_java_runtime from an attribute with the host transition
+# does not work because the dependency is determined based on the configuration
+# *before* the transition.
+alias(
+    name = "java_runtime_alias",
+    actual = "//tools/jdk:current_java_runtime",
+)
+
+# These individual jni_* targets are exposed for legacy reasons.
+# Most users should depend on :jni.
+
+java_runtime_files(
+    name = "jni_header",
+    srcs = ["include/jni.h"],
+)
+
+java_runtime_files(
+    name = "jni_md_header-darwin",
+    srcs = ["include/darwin/jni_md.h"],
+)
+
+java_runtime_files(
+    name = "jni_md_header-linux",
+    srcs = ["include/linux/jni_md.h"],
+)
+
+java_runtime_files(
+    name = "jni_md_header-windows",
+    srcs = ["include/win32/jni_md.h"],
+)
+
+java_runtime_files(
+    name = "jni_md_header-freebsd",
+    srcs = ["include/freebsd/jni_md.h"],
+)
+
+java_runtime_files(
+    name = "jni_md_header-openbsd",
+    srcs = ["include/openbsd/jni_md.h"],
+)
+
+# The Java native interface. Depend on this package if you #include <jni.h>.
+#
+# See test_jni in third_party/bazel/src/test/shell/bazel/bazel_java_test.sh for
+# an example of using Bazel to build a Java program that calls a C function.
+#
+# TODO(ilist): use //src:condition:linux when released in Bazel
+cc_library(
+    name = "jni",
+    hdrs = [":jni_header"] + select({
+        "//src/conditions:linux_aarch64": [":jni_md_header-linux"],
+        "//src/conditions:linux_ppc64le": [":jni_md_header-linux"],
+        "//src/conditions:linux_s390x": [":jni_md_header-linux"],
+        "//src/conditions:linux_mips64": [":jni_md_header-linux"],
+        "//src/conditions:linux_riscv64": [":jni_md_header-linux"],
+        "//src/conditions:linux_x86_64": [":jni_md_header-linux"],
+        "//src/conditions:darwin": [":jni_md_header-darwin"],
+        "//src/conditions:freebsd": [":jni_md_header-freebsd"],
+        "//src/conditions:openbsd": [":jni_md_header-openbsd"],
+        "//src/conditions:windows": [":jni_md_header-windows"],
+        "//conditions:default": [],
+    }),
+    includes = ["include"] + select({
+        "//src/conditions:linux_aarch64": ["include/linux"],
+        "//src/conditions:linux_ppc64le": ["include/linux"],
+        "//src/conditions:linux_s390x": ["include/linux"],
+        "//src/conditions:linux_mips64": ["include/linux"],
+        "//src/conditions:linux_riscv64": ["include/linux"],
+        "//src/conditions:linux_x86_64": ["include/linux"],
+        "//src/conditions:darwin": ["include/darwin"],
+        "//src/conditions:freebsd": ["include/freebsd"],
+        "//src/conditions:openbsd": ["include/openbsd"],
+        "//src/conditions:windows": ["include/win32"],
+        "//conditions:default": [],
+    }),
+)
+
+[
+    (
+        alias(
+            name = "ijar_prebuilt_binary_%s" % OS,
+            actual = "@remote_java_tools_%s//:ijar_prebuilt_binary" % OS,
+            visibility = ["//visibility:private"],
+        ),
+        alias(
+            name = "prebuilt_singlejar_%s" % OS,
+            actual = "@remote_java_tools_%s//:prebuilt_singlejar" % OS,
+            visibility = ["//visibility:private"],
+        ),
+    )
+    for OS in [
+        "linux",
+        "darwin_x86_64",
+        "darwin_arm64",
+        "windows",
+    ]
+]
+
+# On Windows, executables end in ".exe", but the label we reach it through
+# must be platform-independent. Thus, we create a little filegroup that
+# contains the appropriate platform-dependent file.
+alias(
+    name = "ijar",
+    actual = ":ijar_prebuilt_binary_or_cc_binary",
+)
+
+alias(
+    name = "ijar_prebuilt_binary_or_cc_binary",
+    actual = select({
+        "//src/conditions:linux_x86_64": ":ijar_prebuilt_binary_linux",
+        "//src/conditions:darwin_x86_64": ":ijar_prebuilt_binary_darwin_x86_64",
+        "//src/conditions:darwin_arm64": ":ijar_prebuilt_binary_darwin_arm64",
+        "//src/conditions:windows": ":ijar_prebuilt_binary_windows",
+        "//conditions:default": "@remote_java_tools//:ijar_cc_binary",
+    }),
+)
+
+alias(
+    name = "ijar_prebuilt_binary",
+    actual = select({
+        "//src/conditions:linux_x86_64": ":ijar_prebuilt_binary_linux",
+        "//src/conditions:darwin_x86_64": ":ijar_prebuilt_binary_darwin_x86_64",
+        "//src/conditions:darwin_arm64": ":ijar_prebuilt_binary_darwin_arm64",
+        "//src/conditions:windows": ":ijar_prebuilt_binary_windows",
+    }),
+)
+
+# On Windows, Java implementation of singlejar is used. We create a little
+# filegroup that contains the appropriate platform-dependent file.
+# Once https://github.com/bazelbuild/bazel/issues/2241 is fixed (that is,
+# the native singlejar is used on windows), this file group can be reused since
+# on Windows, executables end in ".exe", but the label we reach it through
+# must be platform-independent.
+alias(
+    name = "singlejar",
+    actual = ":singlejar_prebuilt_or_cc_binary",
+)
+
+alias(
+    name = "singlejar_prebuilt_or_cc_binary",
+    actual = select({
+        "//src/conditions:linux_x86_64": ":prebuilt_singlejar_linux",
+        "//src/conditions:darwin_x86_64": ":prebuilt_singlejar_darwin_x86_64",
+        "//src/conditions:darwin_arm64": ":prebuilt_singlejar_darwin_arm64",
+        "//src/conditions:windows": ":prebuilt_singlejar_windows",
+        "//conditions:default": "@remote_java_tools//:singlejar_cc_bin",
+    }),
+)
+
+alias(
+    name = "prebuilt_singlejar",
+    actual = select({
+        "//src/conditions:linux_x86_64": ":prebuilt_singlejar_linux",
+        "//src/conditions:darwin_x86_64": ":prebuilt_singlejar_darwin_x86_64",
+        "//src/conditions:darwin_arm64": ":prebuilt_singlejar_darwin_arm64",
+        "//src/conditions:windows": ":prebuilt_singlejar_windows",
+    }),
+)
+
+exports_files([
+    "BUILD.java_tools",
+])
+
 alias(
     name = "genclass",
     actual = "@remote_java_tools//:GenClass",
@@ -94,6 +278,87 @@ alias(
     actual = ":remote_jdk11",
 )
 
+bootclasspath(
+    name = "platformclasspath",
+    src = "DumpPlatformClassPath.java",
+    host_javabase = ":current_java_runtime",
+    target_javabase = ":current_java_runtime",
+)
+
+default_java_toolchain(
+    name = "toolchain",
+    configuration = DEFAULT_TOOLCHAIN_CONFIGURATION,
+    toolchain_definition = False,
+)
+
+alias(
+    name = "remote_toolchain",
+    actual = ":toolchain",
+)
+
+RELEASES = (8, 9, 10, 11)
+
+[
+    default_java_toolchain(
+        name = "toolchain_java%d" % release,
+        configuration = DEFAULT_TOOLCHAIN_CONFIGURATION,
+        source_version = "%s" % release,
+        target_version = "%s" % release,
+    )
+    for release in RELEASES
+]
+
+# A toolchain that targets java 14.
+default_java_toolchain(
+    name = "toolchain_jdk_14",
+    configuration = dict(),
+    java_runtime = "@bazel_tools//tools/jdk:remotejdk_14",
+    source_version = "14",
+    target_version = "14",
+)
+
+# A toolchain that targets java 15.
+default_java_toolchain(
+    name = "toolchain_jdk_15",
+    configuration = dict(),
+    java_runtime = "@bazel_tools//tools/jdk:remotejdk_15",
+    source_version = "15",
+    target_version = "15",
+)
+
+# A toolchain that targets java 16.
+default_java_toolchain(
+    name = "toolchain_jdk_16",
+    configuration = dict(),
+    java_runtime = "@bazel_tools//tools/jdk:remotejdk_16",
+    source_version = "16",
+    target_version = "16",
+)
+
+# A toolchain that targets java 17.
+default_java_toolchain(
+    name = "toolchain_jdk_17",
+    configuration = dict(),
+    java_runtime = "@bazel_tools//tools/jdk:remotejdk_17",
+    source_version = "17",
+    target_version = "17",
+)
+
+# A toolchain that targets java 20.
+default_java_toolchain(
+    name = "toolchain_jdk_20",
+    configuration = dict(),
+    java_runtime = "@bazel_tools//tools/jdk:remotejdk_20",
+    source_version = "20",
+    target_version = "20",
+)
+
+default_java_toolchain(
+    name = "prebuilt_toolchain",
+    configuration = PREBUILT_TOOLCHAIN_CONFIGURATION,
+    toolchain_definition = False,
+)
+
 filegroup(
     name = "bzl_srcs",
     srcs = glob(["*.bzl"]),
@@ -116,36 +381,66 @@ py_test(
     ],
 )
 
-#### Aliases to rules_java to keep backward-compatibility (begin) ####
-
-TARGET_NAMES = [
-    "java_runtime_alias",
-    "current_host_java_runtime",
-    "current_java_runtime",
-    "current_java_toolchain",
-    "jni",
-    "jni_header",
-    "jni_md_header-darwin",
-    "jni_md_header-freebsd",
-    "jni_md_header-linux",
-    "jni_md_header-openbsd",
-    "jni_md_header-windows",
-    "platformclasspath",
-    "remote_jdk11",
-    "remote_toolchain",
-    "toolchain",
-] + [
-    "toolchain_java%d" % version for version in (8, 9, 10, 11)
+# Aliases for JDKs, so that they are only downloaded when needed.
+_JDKS = [
+    "remotejdk11_macos",
+    "remotejdk11_macos_aarch64",
+    "remotejdk11_win",
+    "remotejdk11_win_arm64",
+    "remotejdk11_linux_aarch64",
+    "remotejdk11_linux",
+    "remotejdk11_linux_ppc64le",
+    "remotejdk11_linux_s390x",
 ] + [
-    "toolchain_jdk_%d" % version for version in (14, 15, 16, 17, 20)
+    "remotejdk%s_%s" % (version, os)
+    for version in ("17", "20")
+    for os in ("linux", "linux_aarch64", "macos", "macos_aarch64", "win") + (("linux_s390x", "win_arm64",) if version != "20" else ())
 ]
 
 [
     alias(
-        name = name,
-        actual = "@rules_java//toolchains:" + name,
+        name = JDK,
+        actual = "@%s//:jdk" % JDK,
+        visibility = ["//visibility:private"],
     )
-    for name in TARGET_NAMES
+    for JDK in _JDKS
 ]
 
-#### Aliases to rules_java to keep backward-compatibility (end) ####
+# A JDK 11 for use as a --host_javabase.
+java_runtime_version_alias(
+    name = "remote_jdk11",
+    runtime_version = "remotejdk_11",
+    visibility = ["//visibility:public"],
+)
+
+java_runtime_version_alias(
+    name = "remotejdk_15",
+    runtime_version = "remotejdk_15",
+    visibility = ["//visibility:public"],
+)
+
+java_runtime_version_alias(
+    name = "remotejdk_16",
+    runtime_version = "remotejdk_16",
+    visibility = ["//visibility:public"],
+)
+
+java_runtime_version_alias(
+    name = "remotejdk_17",
+    runtime_version = "remotejdk_17",
+    visibility = ["//visibility:public"],
+)
+
+java_runtime_version_alias(
+    name = "remotejdk_20",
+    runtime_version = "remotejdk_20",
+    visibility = ["//visibility:public"],
+)
+
+java_runtime_version_alias(
+    name = "jdk_8",
+    runtime_version = "8",
+    visibility = ["//visibility:public"],
+)
+
+exports_files(["java_stub_template.txt"])
diff --git a/tools/jdk/DumpPlatformClassPath.java b/tools/jdk/DumpPlatformClassPath.java
new file mode 100644
index 00000000000000..083285350ba379
--- /dev/null
+++ b/tools/jdk/DumpPlatformClassPath.java
@@ -0,0 +1,269 @@
+// Copyright 2017 The Bazel Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import com.sun.tools.javac.api.JavacTool;
+import com.sun.tools.javac.util.Context;
+import java.io.BufferedOutputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.UncheckedIOException;
+import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.EnumSet;
+import java.util.GregorianCalendar;
+import java.util.List;
+import java.util.Map;
+import java.util.SortedMap;
+import java.util.TreeMap;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.zip.CRC32;
+import java.util.zip.ZipEntry;
+import javax.tools.JavaFileManager;
+import javax.tools.JavaFileObject;
+import javax.tools.JavaFileObject.Kind;
+import javax.tools.StandardJavaFileManager;
+import javax.tools.StandardLocation;
+
+/**
+ * Output a jar file containing all classes on the platform classpath of the given JDK release.
+ *
+ * <p>usage: DumpPlatformClassPath <release version> <output jar> <path to target JDK>?
+ */
+public class DumpPlatformClassPath {
+
+  public static void main(String[] args) throws Exception {
+    if (args.length != 2) {
+      System.err.println("usage: DumpPlatformClassPath <output jar> <path to target JDK>");
+      System.exit(1);
+    }
+    Path output = Paths.get(args[0]);
+    Path targetJavabase = Paths.get(args[1]);
+
+    int hostMajorVersion = hostMajorVersion();
+    boolean ok;
+    if (hostMajorVersion == 8) {
+      ok = dumpJDK8BootClassPath(output, targetJavabase);
+    } else {
+      ok = dumpJDK9AndNewerBootClassPath(hostMajorVersion, output, targetJavabase);
+    }
+    System.exit(ok ? 0 : 1);
+  }
+
+  // JDK 8 bootclasspath handling.
+  // * JDK 8 represents a bootclasspath as a search path of jars (rt.jar, etc.).
+  // * It does not support --release or --system.
+  static boolean dumpJDK8BootClassPath(Path output, Path targetJavabase) throws IOException {
+    List<Path> bootClassPathJars = getBootClassPathJars(targetJavabase);
+    writeClassPathJars(output, bootClassPathJars);
+    return true;
+  }
+
+  // JDK > 8 --host_javabase bootclasspath handling.
+  // (The default --host_javabase is currently JDK 9.)
+  static boolean dumpJDK9AndNewerBootClassPath(
+      int hostMajorVersion, Path output, Path targetJavabase) throws IOException {
+
+    // JDK 9 and newer support cross-compiling to older platform versions using the --system
+    // and --release flags.
+    // * --system takes the path to a JDK root for JDK 9 and up, and causes the compilation
+    //     to target the APIs from that JDK.
+    // * --release takes a language level (e.g. '9') and uses the API information baked in to
+    //     the host JDK (in lib/ct.sym).
+
+    // Since --system only supports JDK >= 9, first check of the target JDK defines a JDK 8
+    // bootclasspath.
+    List<Path> bootClassPathJars = getBootClassPathJars(targetJavabase);
+    if (!bootClassPathJars.isEmpty()) {
+      writeClassPathJars(output, bootClassPathJars);
+      return true;
+    }
+
+    // Initialize a FileManager to process the --system argument, and then read the
+    // initialized bootclasspath data back out.
+
+    Context context = new Context();
+    try {
+      JavacTool.create()
+          .getTask(
+              /* out = */ null,
+              /* fileManager = */ null,
+              /* diagnosticListener = */ null,
+              /* options = */ Arrays.asList("--system", String.valueOf(targetJavabase)),
+              /* classes = */ null,
+              /* compilationUnits = */ null,
+              context);
+    } catch (IllegalArgumentException e) {
+      throw new IllegalArgumentException(
+          String.format(
+              "Failed to collect system class path. Please ensure that the configured Java runtime"
+                  + " ('%s') is a complete JDK. There are known issues with Homebrew versions of"
+                  + " the Java runtime.",
+              targetJavabase.toRealPath()),
+          e);
+    }
+    StandardJavaFileManager fileManager =
+        (StandardJavaFileManager) context.get(JavaFileManager.class);
+
+    SortedMap<String, InputStream> entries = new TreeMap<>();
+    for (JavaFileObject fileObject :
+        fileManager.list(
+            StandardLocation.PLATFORM_CLASS_PATH,
+            "",
+            EnumSet.of(Kind.CLASS),
+            /* recurse= */ true)) {
+      String binaryName =
+          fileManager.inferBinaryName(StandardLocation.PLATFORM_CLASS_PATH, fileObject);
+      entries.put(binaryName.replace('.', '/') + ".class", fileObject.openInputStream());
+    }
+    writeEntries(output, entries);
+    return true;
+  }
+
+  /** Writes the given entry names and data to a jar archive at the given path. */
+  private static void writeEntries(Path output, Map<String, InputStream> entries)
+      throws IOException {
+    if (!entries.containsKey("java/lang/Object.class")) {
+      throw new AssertionError(
+          "\nCould not find java.lang.Object on bootclasspath; something has gone terribly wrong.\n"
+              + "Please file a bug: https://github.com/bazelbuild/bazel/issues");
+    }
+    try (OutputStream os = Files.newOutputStream(output);
+        BufferedOutputStream bos = new BufferedOutputStream(os, 65536);
+        JarOutputStream jos = new JarOutputStream(bos)) {
+      entries.entrySet().stream()
+          .forEachOrdered(
+              entry -> {
+                try {
+                  addEntry(jos, entry.getKey(), entry.getValue());
+                } catch (IOException e) {
+                  throw new UncheckedIOException(e);
+                }
+              });
+    }
+  }
+
+  /** Collects the entries of the given jar files into a map from jar entry names to their data. */
+  private static void writeClassPathJars(Path output, Collection<Path> paths) throws IOException {
+    List<JarFile> jars = new ArrayList<>();
+    for (Path path : paths) {
+      jars.add(new JarFile(path.toFile()));
+    }
+    SortedMap<String, InputStream> entries = new TreeMap<>();
+    for (JarFile jar : jars) {
+      jar.stream()
+          .filter(p -> p.getName().endsWith(".class"))
+          .forEachOrdered(
+              entry -> {
+                try {
+                  entries.put(entry.getName(), jar.getInputStream(entry));
+                } catch (IOException e) {
+                  throw new UncheckedIOException(e);
+                }
+              });
+    }
+    writeEntries(output, entries);
+    for (JarFile jar : jars) {
+      jar.close();
+    }
+  }
+
+  /** Returns paths to the entries of a JDK 8-style bootclasspath. */
+  private static List<Path> getBootClassPathJars(Path javaHome) throws IOException {
+    List<Path> jars = new ArrayList<>();
+    Path extDir = javaHome.resolve("jre/lib/ext");
+    if (Files.exists(extDir)) {
+      for (Path extJar : Files.newDirectoryStream(extDir, "*.jar")) {
+        jars.add(extJar);
+      }
+    }
+    for (String jar :
+        Arrays.asList("rt.jar", "resources.jar", "jsse.jar", "jce.jar", "charsets.jar")) {
+      Path path = javaHome.resolve("jre/lib").resolve(jar);
+      if (Files.exists(path)) {
+        jars.add(path);
+      }
+    }
+    return jars;
+  }
+
+  // Use a fixed timestamp for deterministic jar output.
+  private static final long FIXED_TIMESTAMP =
+      new GregorianCalendar(2010, 0, 1, 0, 0, 0).getTimeInMillis();
+
+  /**
+   * Add a jar entry to the given {@link JarOutputStream}, normalizing the entry timestamps to
+   * ensure deterministic build output.
+   */
+  private static void addEntry(JarOutputStream jos, String name, InputStream input)
+      throws IOException {
+    JarEntry je = new JarEntry(name);
+    je.setTime(FIXED_TIMESTAMP);
+    je.setMethod(ZipEntry.STORED);
+    byte[] bytes = toByteArray(input);
+    // When targeting JDK >= 10, patch the major version so it will be accepted by javac 9
+    // TODO(cushon): remove this after updating javac
+    if (bytes[7] > 53) {
+      bytes[7] = 53;
+    }
+    je.setSize(bytes.length);
+    CRC32 crc = new CRC32();
+    crc.update(bytes);
+    je.setCrc(crc.getValue());
+    jos.putNextEntry(je);
+    jos.write(bytes);
+  }
+
+  private static byte[] toByteArray(InputStream is) throws IOException {
+    byte[] buffer = new byte[8192];
+    ByteArrayOutputStream boas = new ByteArrayOutputStream();
+    while (true) {
+      int r = is.read(buffer);
+      if (r == -1) {
+        break;
+      }
+      boas.write(buffer, 0, r);
+    }
+    return boas.toByteArray();
+  }
+
+  /**
+   * Returns the major version of the host Java runtime (e.g. '8' for JDK 8), using {@link
+   * Runtime#version} if it is available, and otherwise falling back to the {@code
+   * java.class.version} system. property.
+   */
+  static int hostMajorVersion() {
+    try {
+      Method versionMethod = Runtime.class.getMethod("version");
+      Object version = versionMethod.invoke(null);
+      return (int) version.getClass().getMethod("major").invoke(version);
+    } catch (ReflectiveOperationException e) {
+      // Runtime.version() isn't available on JDK 8; continue below
+    }
+    int version = (int) Double.parseDouble(System.getProperty("java.class.version"));
+    if (49 <= version && version <= 52) {
+      return version - (49 - 5);
+    }
+    throw new IllegalStateException(
+        "Unknown Java version: " + System.getProperty("java.specification.version"));
+  }
+}
diff --git a/tools/jdk/default_java_toolchain.bzl b/tools/jdk/default_java_toolchain.bzl
index 5b3320b65c2bde..a83e14e7251c30 100644
--- a/tools/jdk/default_java_toolchain.bzl
+++ b/tools/jdk/default_java_toolchain.bzl
@@ -12,29 +12,276 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Redirect symbols from rules_java to keep backward-compatibility."""
-
-load(
-    "@rules_java//toolchains:default_java_toolchain.bzl",
-    _BASE_JDK9_JVM_OPTS = "BASE_JDK9_JVM_OPTS",
-    _DEFAULT_JAVACOPTS = "DEFAULT_JAVACOPTS",
-    _DEFAULT_TOOLCHAIN_CONFIGURATION = "DEFAULT_TOOLCHAIN_CONFIGURATION",
-    _JDK9_JVM_OPTS = "JDK9_JVM_OPTS",
-    _NONPREBUILT_TOOLCHAIN_CONFIGURATION = "NONPREBUILT_TOOLCHAIN_CONFIGURATION",
-    _PREBUILT_TOOLCHAIN_CONFIGURATION = "PREBUILT_TOOLCHAIN_CONFIGURATION",
-    _VANILLA_TOOLCHAIN_CONFIGURATION = "VANILLA_TOOLCHAIN_CONFIGURATION",
-    _bootclasspath = "bootclasspath",
-    _default_java_toolchain = "default_java_toolchain",
-    _java_runtime_files = "java_runtime_files",
+"""Rules for defining default_java_toolchain"""
+
+# JVM options, without patching java.compiler and jdk.compiler modules.
+BASE_JDK9_JVM_OPTS = [
+    # Allow JavaBuilder to access internal javac APIs.
+    "--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED",
+    "--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED",
+    "--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED",
+    "--add-exports=jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED",
+    "--add-exports=jdk.compiler/com.sun.tools.javac.resources=ALL-UNNAMED",
+    "--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED",
+    "--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED",
+    "--add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED",
+    "--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED",
+    "--add-opens=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED",
+    "--add-opens=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED",
+
+    # quiet warnings from com.google.protobuf.UnsafeUtil,
+    # see: https://github.com/google/protobuf/issues/3781
+    # and: https://github.com/bazelbuild/bazel/issues/5599
+    "--add-opens=java.base/java.nio=ALL-UNNAMED",
+    "--add-opens=java.base/java.lang=ALL-UNNAMED",
+
+    # TODO(b/64485048): Disable this option in persistent worker mode only.
+    # Disable symlinks resolution cache since symlinks in exec root change
+    "-Dsun.io.useCanonCaches=false",
+
+    # Compact strings make JavaBuilder slightly slower.
+    "-XX:-CompactStrings",
+
+    # Since https://bugs.openjdk.org/browse/JDK-8153723, JVM logging goes to stdout. This
+    # makes it go to stderr instead.
+    "-Xlog:disable",
+    "-Xlog:all=warning:stderr:uptime,level,tags",
+]
+
+JDK9_JVM_OPTS = BASE_JDK9_JVM_OPTS
+
+DEFAULT_JAVACOPTS = [
+    "-XDskipDuplicateBridges=true",
+    "-XDcompilePolicy=simple",
+    "-g",
+    "-parameters",
+    # https://github.com/bazelbuild/bazel/issues/15219
+    "-Xep:ReturnValueIgnored:OFF",
+    # https://github.com/bazelbuild/bazel/issues/16996
+    "-Xep:IgnoredPureGetter:OFF",
+    "-Xep:EmptyTopLevelDeclaration:OFF",
+    "-Xep:LenientFormatStringValidation:OFF",
+    "-Xep:ReturnMissingNullable:OFF",
+]
+
+# Default java_toolchain parameters
+_BASE_TOOLCHAIN_CONFIGURATION = dict(
+    forcibly_disable_header_compilation = False,
+    genclass = ["@remote_java_tools//:GenClass"],
+    header_compiler = ["@remote_java_tools//:TurbineDirect"],
+    header_compiler_direct = ["@remote_java_tools//:TurbineDirect"],
+    ijar = ["@bazel_tools//tools/jdk:ijar"],
+    javabuilder = ["@remote_java_tools//:JavaBuilder"],
+    javac_supports_workers = True,
+    jacocorunner = "@remote_java_tools//:jacoco_coverage_runner_filegroup",
+    jvm_opts = BASE_JDK9_JVM_OPTS,
+    turbine_jvm_opts = [
+        # Turbine is not a worker and parallel GC is faster for short-lived programs.
+        "-XX:+UseParallelGC",
+    ],
+    misc = DEFAULT_JAVACOPTS,
+    singlejar = ["@bazel_tools//tools/jdk:singlejar"],
+    # Code to enumerate target JVM boot classpath uses host JVM. Because
+    # java_runtime-s are involved, its implementation is in @bazel_tools.
+    bootclasspath = ["@bazel_tools//tools/jdk:platformclasspath"],
+    source_version = "8",
+    target_version = "8",
+    reduced_classpath_incompatible_processors = [
+        "dagger.hilt.processor.internal.root.RootProcessor",  # see b/21307381
+    ],
+    java_runtime = "@bazel_tools//tools/jdk:remotejdk_17",
+)
+
+DEFAULT_TOOLCHAIN_CONFIGURATION = _BASE_TOOLCHAIN_CONFIGURATION
+
+# The 'vanilla' toolchain is an unsupported alternative to the default.
+#
+# It does not provide any of the following features:
+#   * Error Prone
+#   * Strict Java Deps
+#   * Reduced Classpath Optimization
+#
+# It uses the version of internal javac from the `--host_javabase` JDK instead
+# of providing a javac. Internal javac may not be source- or bug-compatible with
+# the javac that is provided with other toolchains.
+#
+# However it does allow using a wider range of `--host_javabase`s, including
+# versions newer than the current JDK.
+VANILLA_TOOLCHAIN_CONFIGURATION = dict(
+    javabuilder = ["@remote_java_tools//:VanillaJavaBuilder"],
+    jvm_opts = [],
+    java_runtime = None,
+)
+
+# The new toolchain is using all the pre-built tools, including
+# singlejar and ijar, even on remote execution. This toolchain
+# should be used only when host and execution platform are the
+# same, otherwise the binaries will not work on the execution
+# platform.
+PREBUILT_TOOLCHAIN_CONFIGURATION = dict(
+    ijar = ["@bazel_tools//tools/jdk:ijar_prebuilt_binary"],
+    singlejar = ["@bazel_tools//tools/jdk:prebuilt_singlejar"],
+)
+
+# The new toolchain is using all the tools from sources.
+NONPREBUILT_TOOLCHAIN_CONFIGURATION = dict(
+    ijar = ["@remote_java_tools//:ijar_cc_binary"],
+    singlejar = ["@remote_java_tools//:singlejar_cc_bin"],
+)
+
+_DEFAULT_SOURCE_VERSION = "8"
+
+def default_java_toolchain(name, configuration = DEFAULT_TOOLCHAIN_CONFIGURATION, toolchain_definition = True, exec_compatible_with = [], target_compatible_with = [], **kwargs):
+    """Defines a remote java_toolchain with appropriate defaults for Bazel.
+
+    Args:
+        name: The name of the toolchain
+        configuration: Toolchain configuration
+        toolchain_definition: Whether to define toolchain target and its config setting
+        exec_compatible_with: A list of constraint values that must be
+            satisifed for the exec platform.
+        target_compatible_with: A list of constraint values that must be
+            satisifed for the target platform.
+        **kwargs: More arguments for the java_toolchain target
+    """
+
+    toolchain_args = dict(_BASE_TOOLCHAIN_CONFIGURATION)
+    toolchain_args.update(configuration)
+    toolchain_args.update(kwargs)
+    native.java_toolchain(
+        name = name,
+        **toolchain_args
+    )
+    if toolchain_definition:
+        source_version = toolchain_args["source_version"]
+        if source_version == _DEFAULT_SOURCE_VERSION:
+            native.config_setting(
+                name = name + "_default_version_setting",
+                values = {"java_language_version": ""},
+                visibility = ["//visibility:private"],
+            )
+            native.toolchain(
+                name = name + "_default_definition",
+                toolchain_type = "@bazel_tools//tools/jdk:toolchain_type",
+                target_settings = [name + "_default_version_setting"],
+                toolchain = name,
+                exec_compatible_with = exec_compatible_with,
+                target_compatible_with = target_compatible_with,
+            )
+
+        native.config_setting(
+            name = name + "_version_setting",
+            values = {"java_language_version": source_version},
+            visibility = ["//visibility:private"],
+        )
+        native.toolchain(
+            name = name + "_definition",
+            toolchain_type = "@bazel_tools//tools/jdk:toolchain_type",
+            target_settings = [name + "_version_setting"],
+            toolchain = name,
+            exec_compatible_with = exec_compatible_with,
+            target_compatible_with = target_compatible_with,
+        )
+
+def java_runtime_files(name, srcs):
+    """Copies the given sources out of the current Java runtime."""
+
+    native.filegroup(
+        name = name,
+        srcs = srcs,
+        tags = ["manual"],
+    )
+    for src in srcs:
+        native.genrule(
+            name = "gen_%s" % src,
+            srcs = ["@bazel_tools//tools/jdk:current_java_runtime"],
+            toolchains = ["@bazel_tools//tools/jdk:current_java_runtime"],
+            cmd = "cp $(JAVABASE)/%s $@" % src,
+            outs = [src],
+            tags = ["manual"],
+        )
+
+def _bootclasspath_impl(ctx):
+    host_javabase = ctx.attr.host_javabase[java_common.JavaRuntimeInfo]
+
+    class_dir = ctx.actions.declare_directory("%s_classes" % ctx.label.name)
+
+    args = ctx.actions.args()
+    args.add("-source")
+    args.add("8")
+    args.add("-target")
+    args.add("8")
+    args.add("-Xlint:-options")
+    args.add("-d")
+    args.add_all([class_dir], expand_directories = False)
+    args.add(ctx.file.src)
+
+    ctx.actions.run(
+        executable = "%s/bin/javac" % host_javabase.java_home,
+        mnemonic = "JavaToolchainCompileClasses",
+        inputs = [ctx.file.src] + ctx.files.host_javabase,
+        outputs = [class_dir],
+        arguments = [args],
+    )
+
+    bootclasspath = ctx.outputs.output_jar
+
+    inputs = [class_dir] + ctx.files.host_javabase
+
+    args = ctx.actions.args()
+    args.add("-XX:+IgnoreUnrecognizedVMOptions")
+    args.add("--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED")
+    args.add("--add-exports=jdk.compiler/com.sun.tools.javac.platform=ALL-UNNAMED")
+    args.add("--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED")
+    args.add_all("-cp", [class_dir], expand_directories = False)
+    args.add("DumpPlatformClassPath")
+    args.add(bootclasspath)
+
+    system_files = ("release", "modules", "jrt-fs.jar")
+    system = [f for f in ctx.files.target_javabase if f.basename in system_files]
+    if len(system) != len(system_files):
+        system = None
+    if ctx.attr.target_javabase:
+        inputs.extend(ctx.files.target_javabase)
+        args.add(ctx.attr.target_javabase[java_common.JavaRuntimeInfo].java_home)
+
+    ctx.actions.run(
+        executable = str(host_javabase.java_executable_exec_path),
+        mnemonic = "JavaToolchainCompileBootClasspath",
+        inputs = inputs,
+        outputs = [bootclasspath],
+        arguments = [args],
+    )
+    return [
+        DefaultInfo(files = depset([bootclasspath])),
+        java_common.BootClassPathInfo(
+            bootclasspath = [bootclasspath],
+            system = system,
+        ),
+        OutputGroupInfo(jar = [bootclasspath]),
+    ]
+
+_bootclasspath = rule(
+    implementation = _bootclasspath_impl,
+    attrs = {
+        "host_javabase": attr.label(
+            cfg = "exec",
+            providers = [java_common.JavaRuntimeInfo],
+        ),
+        "output_jar": attr.output(mandatory = True),
+        "src": attr.label(
+            cfg = "exec",
+            allow_single_file = True,
+        ),
+        "target_javabase": attr.label(
+            providers = [java_common.JavaRuntimeInfo],
+        ),
+    },
 )
 
-default_java_toolchain = _default_java_toolchain
-java_runtime_files = _java_runtime_files
-bootclasspath = _bootclasspath
-DEFAULT_TOOLCHAIN_CONFIGURATION = _DEFAULT_TOOLCHAIN_CONFIGURATION
-BASE_JDK9_JVM_OPTS = _BASE_JDK9_JVM_OPTS
-JDK9_JVM_OPTS = _JDK9_JVM_OPTS
-DEFAULT_JAVACOPTS = _DEFAULT_JAVACOPTS
-VANILLA_TOOLCHAIN_CONFIGURATION = _VANILLA_TOOLCHAIN_CONFIGURATION
-PREBUILT_TOOLCHAIN_CONFIGURATION = _PREBUILT_TOOLCHAIN_CONFIGURATION
-NONPREBUILT_TOOLCHAIN_CONFIGURATION = _NONPREBUILT_TOOLCHAIN_CONFIGURATION
+def bootclasspath(name, **kwargs):
+    _bootclasspath(
+        name = name,
+        output_jar = name + ".jar",
+        **kwargs
+    )
diff --git a/tools/jdk/fail_rule.bzl b/tools/jdk/fail_rule.bzl
new file mode 100644
index 00000000000000..a8a3da28cc7417
--- /dev/null
+++ b/tools/jdk/fail_rule.bzl
@@ -0,0 +1,35 @@
+# Copyright 2020 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""A rule than fails during analysis."""
+
+def _fail_rule_impl(ctx):
+    if ctx.attr.header:
+        fail("%s %s" % (ctx.attr.header, ctx.attr.message))
+    else:
+        fail(ctx.attr.message)
+
+fail_rule = rule(
+    doc = "A rule that fails during analysis.",
+    implementation = _fail_rule_impl,
+    attrs = {
+        "header": attr.string(
+            doc = "Header of the message.",
+        ),
+        "message": attr.string(
+            mandatory = True,
+            doc = "Message to display.",
+        ),
+    },
+)
diff --git a/tools/jdk/java_toolchain_alias.bzl b/tools/jdk/java_toolchain_alias.bzl
index 7592e65f8fa18b..989d78d17a6179 100644
--- a/tools/jdk/java_toolchain_alias.bzl
+++ b/tools/jdk/java_toolchain_alias.bzl
@@ -1,4 +1,4 @@
-# Copyright 2023 The Bazel Authors. All rights reserved.
+# Copyright 2019 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,10 +12,101 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Redirect symbols from rules_java to keep backward-compatibility."""
+"""Experimental re-implementations of Java toolchain aliases using toolchain resolution."""
 
-load("@rules_java//toolchains:java_toolchain_alias.bzl", _java_host_runtime_alias = "java_host_runtime_alias", _java_runtime_alias = "java_runtime_alias", _java_toolchain_alias = "java_toolchain_alias")
+def _java_runtime_alias(ctx):
+    """An experimental implementation of java_runtime_alias using toolchain resolution."""
+    toolchain_info = ctx.toolchains["@bazel_tools//tools/jdk:runtime_toolchain_type"]
+    toolchain = toolchain_info.java_runtime
+    return [
+        toolchain_info,
+        toolchain,
+        platform_common.TemplateVariableInfo({
+            "JAVA": str(toolchain.java_executable_exec_path),
+            "JAVABASE": str(toolchain.java_home),
+        }),
+        # See b/65239471 for related discussion of handling toolchain runfiles/data.
+        DefaultInfo(
+            runfiles = ctx.runfiles(transitive_files = toolchain.files),
+            files = toolchain.files,
+        ),
+    ]
 
-java_toolchain_alias = _java_toolchain_alias
-java_runtime_alias = _java_runtime_alias
-java_host_runtime_alias = _java_host_runtime_alias
+java_runtime_alias = rule(
+    implementation = _java_runtime_alias,
+    toolchains = ["@bazel_tools//tools/jdk:runtime_toolchain_type"],
+    incompatible_use_toolchain_transition = True,
+)
+
+def _java_host_runtime_alias(ctx):
+    """An experimental implementation of java_host_runtime_alias using toolchain resolution."""
+    runtime = ctx.attr._runtime
+    java_runtime = runtime[java_common.JavaRuntimeInfo]
+    template_variable_info = runtime[platform_common.TemplateVariableInfo]
+    toolchain_info = platform_common.ToolchainInfo(java_runtime = java_runtime)
+    return [
+        java_runtime,
+        template_variable_info,
+        toolchain_info,
+        runtime[DefaultInfo],
+    ]
+
+java_host_runtime_alias = rule(
+    implementation = _java_host_runtime_alias,
+    attrs = {
+        "_runtime": attr.label(
+            default = Label("@bazel_tools//tools/jdk:current_java_runtime"),
+            providers = [
+                java_common.JavaRuntimeInfo,
+                platform_common.TemplateVariableInfo,
+            ],
+            cfg = "exec",
+        ),
+    },
+    provides = [
+        java_common.JavaRuntimeInfo,
+        platform_common.TemplateVariableInfo,
+        platform_common.ToolchainInfo,
+    ],
+)
+
+def _java_runtime_transition_impl(settings, attr):
+    return {"//command_line_option:java_runtime_version": attr.runtime_version}
+
+_java_runtime_transition = transition(
+    implementation = _java_runtime_transition_impl,
+    inputs = [],
+    outputs = ["//command_line_option:java_runtime_version"],
+)
+
+java_runtime_version_alias = rule(
+    implementation = _java_runtime_alias,
+    toolchains = ["@bazel_tools//tools/jdk:runtime_toolchain_type"],
+    incompatible_use_toolchain_transition = True,
+    attrs = {
+        "runtime_version": attr.string(mandatory = True),
+        "_allowlist_function_transition": attr.label(
+            default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
+        ),
+    },
+    cfg = _java_runtime_transition,
+)
+
+def _java_toolchain_alias(ctx):
+    """An experimental implementation of java_toolchain_alias using toolchain resolution."""
+    toolchain_info = ctx.toolchains["@bazel_tools//tools/jdk:toolchain_type"]
+    toolchain = toolchain_info.java
+    return struct(
+        providers = [
+            toolchain_info,
+            toolchain,
+        ],
+        # Use the legacy provider syntax for compatibility with the native rules.
+        java_toolchain = toolchain,
+    )
+
+java_toolchain_alias = rule(
+    implementation = _java_toolchain_alias,
+    toolchains = ["@bazel_tools//tools/jdk:toolchain_type"],
+    incompatible_use_toolchain_transition = True,
+)
diff --git a/tools/jdk/jdk_build_file.bzl b/tools/jdk/jdk_build_file.bzl
new file mode 100644
index 00000000000000..6d001c6bb9c21a
--- /dev/null
+++ b/tools/jdk/jdk_build_file.bzl
@@ -0,0 +1,88 @@
+# Copyright 2023 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""A templated BUILD file for Java repositories."""
+
+JDK_BUILD_TEMPLATE = """load("@rules_java//java:defs.bzl", "java_runtime")
+
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["BUILD.bazel"])
+
+filegroup(
+    name = "jre",
+    srcs = glob(
+        [
+            "jre/bin/**",
+            "jre/lib/**",
+        ],
+        allow_empty = True,
+        # In some configurations, Java browser plugin is considered harmful and
+        # common antivirus software blocks access to npjp2.dll interfering with Bazel,
+        # so do not include it in JRE on Windows.
+        exclude = ["jre/bin/plugin2/**"],
+    ),
+)
+
+filegroup(
+    name = "jdk-bin",
+    srcs = glob(
+        ["bin/**"],
+        # The JDK on Windows sometimes contains a directory called
+        # "%systemroot%", which is not a valid label.
+        exclude = ["**/*%*/**"],
+    ),
+)
+
+# This folder holds security policies.
+filegroup(
+    name = "jdk-conf",
+    srcs = glob(
+        ["conf/**"],
+        allow_empty = True,
+    ),
+)
+
+filegroup(
+    name = "jdk-include",
+    srcs = glob(
+        ["include/**"],
+        allow_empty = True,
+    ),
+)
+
+filegroup(
+    name = "jdk-lib",
+    srcs = glob(
+        ["lib/**", "release"],
+        allow_empty = True,
+        exclude = [
+            "lib/missioncontrol/**",
+            "lib/visualvm/**",
+        ],
+    ),
+)
+
+java_runtime(
+    name = "jdk",
+    srcs = [
+        ":jdk-bin",
+        ":jdk-conf",
+        ":jdk-include",
+        ":jdk-lib",
+        ":jre",
+    ],
+    version = {RUNTIME_VERSION},
+)
+"""
diff --git a/tools/jdk/local_java_repository.bzl b/tools/jdk/local_java_repository.bzl
index 037244020ec0b1..74cbf0b4690d86 100644
--- a/tools/jdk/local_java_repository.bzl
+++ b/tools/jdk/local_java_repository.bzl
@@ -1,4 +1,4 @@
-# Copyright 2023 The Bazel Authors. All rights reserved.
+# Copyright 2020 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,10 +12,224 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Redirect symbols from rules_java to keep backward-compatibility."""
+"""Rules for importing and registering a local JDK."""
 
-load("@rules_java//toolchains:local_java_repository.bzl", _local_java_repository = "local_java_repository")
+load(":default_java_toolchain.bzl", "default_java_toolchain")
 
-def local_java_repository(name, **kwargs):
-    _local_java_repository(name, **kwargs)
+def _detect_java_version(repository_ctx, java_bin):
+    properties_out = repository_ctx.execute([java_bin, "-XshowSettings:properties"]).stderr
+    # This returns an indented list of properties separated with newlines:
+    # "  java.vendor.url.bug = ... \n"
+    # "  java.version = 11.0.8\n"
+    # "  java.version.date = 2020-11-05\"
+
+    strip_properties = [property.strip() for property in properties_out.splitlines()]
+    version_property = [property for property in strip_properties if property.startswith("java.version = ")]
+    if len(version_property) != 1:
+        return None
+
+    version_value = version_property[0][len("java.version = "):]
+    parts = version_value.split(".")
+    major = parts[0]
+    if len(parts) == 1:
+        return major
+    elif major == "1":  # handles versions below 1.8
+        minor = parts[1]
+        return minor
+    return major
+
+def local_java_runtime(name, java_home, version, runtime_name = None, visibility = ["//visibility:public"], exec_compatible_with = [], target_compatible_with = []):
+    """Defines a java_runtime target together with Java runtime and compile toolchain definitions.
+
+    Java runtime toolchain is constrained by flag --java_runtime_version having
+    value set to either name or version argument.
+
+    Java compile toolchains are created for --java_language_version flags values
+    between 8 and version (inclusive). Java compile toolchains use the same
+    (local) JDK for compilation. This requires a different configuration for JDK8
+    than the newer versions.
+
+    Args:
+      name: name of the target.
+      java_home: Path to the JDK.
+      version: Version of the JDK.
+      runtime_name: name of java_runtime target if it already exists.
+      visibility: Visibility that will be applied to the java runtime target
+    """
+    if runtime_name == None:
+        runtime_name = name
+        native.java_runtime(
+            name = runtime_name,
+            java_home = java_home,
+            visibility = visibility,
+            version = int(version) if version.isdigit() else 0,
+        )
+
+    native.config_setting(
+        name = name + "_name_setting",
+        values = {"java_runtime_version": name},
+        visibility = ["//visibility:private"],
+    )
+    native.config_setting(
+        name = name + "_version_setting",
+        values = {"java_runtime_version": version},
+        visibility = ["//visibility:private"],
+    )
+    native.config_setting(
+        name = name + "_name_version_setting",
+        values = {"java_runtime_version": name + "_" + version},
+        visibility = ["//visibility:private"],
+    )
+    native.alias(
+        name = name + "_settings_alias",
+        actual = select({
+            name + "_name_setting": name + "_name_setting",
+            name + "_version_setting": name + "_version_setting",
+            "//conditions:default": name + "_name_version_setting",
+        }),
+        visibility = ["//visibility:private"],
+    )
+    native.toolchain(
+        name = "runtime_toolchain_definition",
+        target_settings = [":%s_settings_alias" % name],
+        toolchain_type = "@bazel_tools//tools/jdk:runtime_toolchain_type",
+        toolchain = runtime_name,
+    )
+
+    if type(version) == type("") and version.isdigit() and int(version) > 8:
+        for version in range(8, int(version) + 1):
+            default_java_toolchain(
+                name = name + "_toolchain_java" + str(version),
+                source_version = str(version),
+                target_version = str(version),
+                java_runtime = runtime_name,
+                exec_compatible_with = exec_compatible_with,
+                target_compatible_with = target_compatible_with,
+            )
+
+    # else version is not recognized and no compilation toolchains are predefined
+
+def _local_java_repository_impl(repository_ctx):
+    """Repository rule local_java_repository implementation.
+
+    Args:
+      repository_ctx: repository context
+    """
+    java_home = repository_ctx.attr.java_home
+    java_home_path = repository_ctx.path(java_home)
+    if not java_home_path.exists:
+        fail(('The path indicated by the "java_home" attribute "%s" (absolute: "%s") ' +
+              "does not exist.") % (java_home, str(java_home_path)))
+
+    repository_ctx.file(
+        "WORKSPACE",
+        "# DO NOT EDIT: automatically generated WORKSPACE file for local_java_repository\n" +
+        "workspace(name = \"{name}\")\n".format(name = repository_ctx.name),
+    )
+
+    extension = ".exe" if repository_ctx.os.name.find("windows") != -1 else ""
+    java_bin = java_home_path.get_child("bin", "java" + extension)
+
+    if not java_bin.exists:
+        # Java binary does not exist
+        repository_ctx.file(
+            "BUILD.bazel",
+            _NOJDK_BUILD_TPL.format(
+                local_jdk = repository_ctx.name,
+                java_binary = "bin/java" + extension,
+                java_home = java_home,
+            ),
+            False,
+        )
+        return
+
+    # Detect version
+    version = repository_ctx.attr.version if repository_ctx.attr.version != "" else _detect_java_version(repository_ctx, java_bin)
+
+    # Prepare BUILD file using "local_java_runtime" macro
+    if repository_ctx.attr.build_file_content and repository_ctx.attr.build_file:
+        fail("build_file and build_file_content are exclusive")
+    if repository_ctx.attr.build_file_content:
+        build_file = repository_ctx.attr.build_file_content
+    elif repository_ctx.attr.build_file:
+        build_file = repository_ctx.read(repository_ctx.path(repository_ctx.attr.build_file))
+    else:
+        build_file = ""
+    build_file = build_file.format(RUNTIME_VERSION = version if version.isdigit() else "0")
+
+    runtime_name = '"jdk"' if build_file else None
+    local_java_runtime_macro = """
+local_java_runtime(
+    name = "%s",
+    runtime_name = %s,
+    java_home = "%s",
+    version = "%s",
+)
+""" % (repository_ctx.name, runtime_name, java_home, version)
+
+    repository_ctx.file(
+        "BUILD.bazel",
+        'load("@bazel_tools//tools/jdk:local_java_repository.bzl", "local_java_runtime")\n' +
+        build_file +
+        local_java_runtime_macro,
+    )
+
+    # Symlink all files
+    for file in repository_ctx.path(java_home).readdir():
+        repository_ctx.symlink(file, file.basename)
+
+# Build file template, when JDK does not exist
+_NOJDK_BUILD_TPL = '''load("@bazel_tools//tools/jdk:fail_rule.bzl", "fail_rule")
+fail_rule(
+   name = "jdk",
+   header = "Auto-Configuration Error:",
+   message = ("Cannot find Java binary {java_binary} in {java_home}; either correct your JAVA_HOME, " +
+          "PATH or specify Java from remote repository (e.g. " +
+          "--java_runtime_version=remotejdk_11)")
+)
+config_setting(
+   name = "localjdk_setting",
+   values = {{"java_runtime_version": "{local_jdk}"}},
+   visibility = ["//visibility:private"],
+)
+toolchain(
+   name = "runtime_toolchain_definition",
+   target_settings = [":localjdk_setting"],
+   toolchain_type = "@bazel_tools//tools/jdk:runtime_toolchain_type",
+   toolchain = ":jdk",
+)
+'''
+
+_local_java_repository_rule = repository_rule(
+    implementation = _local_java_repository_impl,
+    local = True,
+    configure = True,
+    attrs = {
+        "java_home": attr.string(),
+        "version": attr.string(),
+        "build_file": attr.label(),
+        "build_file_content": attr.string(),
+    },
+)
+
+def local_java_repository(name, java_home, version = "", build_file = None, build_file_content = None):
+    """Registers a runtime toolchain for local JDK and creates an unregistered compile toolchain.
+
+    Toolchain resolution is constrained with --java_runtime_version flag
+    having value of the "name" or "version" parameter.
+
+    Java compile toolchains are created for --java_language_version flags values
+    between 8 and version (inclusive). Java compile toolchains use the same
+    (local) JDK for compilation.
+
+    If there is no JDK "virtual" targets are created, which fail only when actually needed.
+
+    Args:
+      name: A unique name for this rule.
+      java_home: Location of the JDK imported.
+      build_file: optionally BUILD file template
+      build_file_content: optional BUILD file template as a string
+      version: optionally java version
+    """
+    _local_java_repository_rule(name = name, java_home = java_home, version = version, build_file = build_file, build_file_content = build_file_content)
     native.register_toolchains("@" + name + "//:runtime_toolchain_definition")
diff --git a/tools/jdk/remote_java_repository.bzl b/tools/jdk/remote_java_repository.bzl
index b4ab1da279330b..c2d81ca0e79919 100644
--- a/tools/jdk/remote_java_repository.bzl
+++ b/tools/jdk/remote_java_repository.bzl
@@ -1,4 +1,4 @@
-# Copyright 2023 The Bazel Authors. All rights reserved.
+# Copyright 2020 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,10 +12,78 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Redirect symbols from rules_java to keep backward-compatibility."""
+"""Rules for importing and registering JDKs from http archive.
 
-load("@rules_java//toolchains:remote_java_repository.bzl", _remote_java_repository = "remote_java_repository")
+Rule remote_java_repository imports and registers JDK with the toolchain resolution.
+"""
 
-def remote_java_repository(name, **kwargs):
-    _remote_java_repository(name, **kwargs)
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/jdk:jdk_build_file.bzl", "JDK_BUILD_TEMPLATE")
+
+def _toolchain_config_impl(ctx):
+    ctx.file("WORKSPACE", "workspace(name = \"{name}\")\n".format(name = ctx.name))
+    ctx.file("BUILD.bazel", ctx.attr.build_file)
+
+_toolchain_config = repository_rule(
+    local = True,
+    implementation = _toolchain_config_impl,
+    attrs = {
+        "build_file": attr.string(),
+    },
+)
+
+def remote_java_repository(name, version, target_compatible_with = None, prefix = "remotejdk", **kwargs):
+    """Imports and registers a JDK from a http archive.
+
+    Toolchain resolution is determined with target_compatible_with
+    parameter and constrained with --java_runtime_version flag either having value
+    of "version" or "{prefix}_{version}" parameters.
+
+    Args:
+      name: A unique name for this rule.
+      version: Version of the JDK imported.
+      target_compatible_with: Target platform constraints (CPU and OS) for this JDK.
+      prefix: Optional alternative prefix for configuration flag value used to determine this JDK.
+      **kwargs: Refer to http_archive documentation
+    """
+    http_archive(
+        name = name,
+        build_file_content = JDK_BUILD_TEMPLATE.format(RUNTIME_VERSION = version),
+        **kwargs
+    )
+    _toolchain_config(
+        name = name + "_toolchain_config_repo",
+        build_file = """
+config_setting(
+    name = "prefix_version_setting",
+    values = {{"java_runtime_version": "{prefix}_{version}"}},
+    visibility = ["//visibility:private"],
+)
+config_setting(
+    name = "version_setting",
+    values = {{"java_runtime_version": "{version}"}},
+    visibility = ["//visibility:private"],
+)
+alias(
+    name = "version_or_prefix_version_setting",
+    actual = select({{
+        ":version_setting": ":version_setting",
+        "//conditions:default": ":prefix_version_setting",
+    }}),
+    visibility = ["//visibility:private"],
+)
+toolchain(
+    name = "toolchain",
+    target_compatible_with = {target_compatible_with},
+    target_settings = [":version_or_prefix_version_setting"],
+    toolchain_type = "@bazel_tools//tools/jdk:runtime_toolchain_type",
+    toolchain = "{toolchain}",
+)
+""".format(
+            prefix = prefix,
+            version = version,
+            target_compatible_with = target_compatible_with,
+            toolchain = "@{repo}//:jdk".format(repo = name),
+        ),
+    )
     native.register_toolchains("@" + name + "_toolchain_config_repo//:toolchain")
diff --git a/tools/jdk/toolchain_utils.bzl b/tools/jdk/toolchain_utils.bzl
index 2c771b91089d13..b2f688bce138f2 100644
--- a/tools/jdk/toolchain_utils.bzl
+++ b/tools/jdk/toolchain_utils.bzl
@@ -1,4 +1,4 @@
-# Copyright 2023 The Bazel Authors. All rights reserved.
+# Copyright 2019 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -11,14 +11,36 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+"""
+Finds the Java toolchain.
+Returns the toolchain if enabled, and falls back to a toolchain constructed from
+legacy toolchain selection.
+"""
 
-"""Redirect symbols from rules_java to keep backward-compatibility."""
+def find_java_toolchain(ctx, target):
+    """
+    Finds the Java toolchain.
+    If the Java toolchain is in use, returns it.  Otherwise, returns a Java
+    toolchain derived from legacy toolchain selection.
+    Args:
+      ctx: The rule context for which to find a toolchain.
+      target: A java_toolchain target (for legacy toolchain resolution).
+    Returns:
+      A JavaToolchainInfo.
+    """
+    _ignore = [ctx]
+    return target[java_common.JavaToolchainInfo]
 
-load(
-    "@rules_java//toolchains:toolchain_utils.bzl",
-    _find_java_runtime_toolchain = "find_java_runtime_toolchain",
-    _find_java_toolchain = "find_java_toolchain",
-)
-
-find_java_toolchain = _find_java_toolchain
-find_java_runtime_toolchain = _find_java_runtime_toolchain
+def find_java_runtime_toolchain(ctx, target):
+    """
+    Finds the Java runtime.
+    If the Java toolchain is in use, returns it.  Otherwise, returns a Java
+    runtime derived from legacy toolchain selection.
+    Args:
+      ctx: The rule context for which to find a toolchain.
+      target: A java_runtime target (for legacy toolchain resolution).
+    Returns:
+      A JavaRuntimeInfo.
+    """
+    _ignore = [ctx]
+    return target[java_common.JavaRuntimeInfo]