diff --git a/.bazelrc b/.bazelrc
index 32c3df4..4e37dcc 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -10,7 +10,6 @@ build --stamp
 # Make /tmp hermetic
 build --sandbox_tmpfs_path=/tmp
 
-# Ensure that Bazel never runs as root, which can cause unit tests to fail.
 build --sandbox_fake_username
 
 test:unit --build_tests_only
diff --git a/.bazelversion b/.bazelversion
index fd2a018..40c341b 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-3.1.0
+3.6.0
diff --git a/README.md b/README.md
index 1e9ac3d..146f3e9 100644
--- a/README.md
+++ b/README.md
@@ -30,4 +30,4 @@ bazelisk sync
 
 ## Considerations
 
-Some tools were inspired by [atlassian/bazel-tools](https://github.com/atlassian/bazel-tools) and/or copied from [Kubernetes](https://github.com/kubernetes/kubernetes).
+`run_in_workspace` was copied from [Kubernetes](https://github.com/kubernetes/kubernetes).
diff --git a/bazel/platforms/BUILD b/bazel/platforms/BUILD
new file mode 100644
index 0000000..8b87764
--- /dev/null
+++ b/bazel/platforms/BUILD
@@ -0,0 +1,25 @@
+package(default_visibility = ["//visibility:public"])
+
+config_setting(
+    name = "windows-x86_64",
+    constraint_values = [
+        "@platforms//os:windows",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "macos-x86_64",
+    constraint_values = [
+        "@platforms//os:macos",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "linux-x86_64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+)
diff --git a/drone-cli/BUILD b/drone-cli/BUILD
index ffd0fb0..aa9eb79 100644
--- a/drone-cli/BUILD
+++ b/drone-cli/BUILD
@@ -1 +1,9 @@
-package(default_visibility = ["//visibility:public"])
+alias(
+    name = "run",
+    actual = select({
+        "@com_github_danmx_bazel_tools//bazel/platforms:linux-x86_64": "@drone-linux-amd64//:drone",
+        "@com_github_danmx_bazel_tools//bazel/platforms:macos-x86_64": "@drone-darwin-amd64//:drone",
+        "@com_github_danmx_bazel_tools//bazel/platforms:windows-x86_64": "@drone-windows-amd64//:drone",
+    }),
+    visibility = ["//visibility:public"],
+)
diff --git a/drone-cli/README.md b/drone-cli/README.md
index af42263..ad46a0c 100644
--- a/drone-cli/README.md
+++ b/drone-cli/README.md
@@ -18,28 +18,13 @@ git_repository(
     shallow_since = "<bla>",
 )
 
-load("@com_github_danmx_bazel_tools//drone-cli:deps.bzl", "drone_dependencies")
+load("@com_github_danmx_bazel_tools//drone-cli:deps.bzl", "drone_cli_dependencies")
 
-drone_dependencies()
-```
-
-`BUILD.bazel` typically in the workspace root:
-
-```bzl
-load("@com_github_danmx_bazel_tools//drone-cli:def.bzl", "drone")
-
-drone(
-    name = "drone-fmt",
-    args = [
-        "fmt",
-        "--save",
-        ".drone.yml",
-    ],
-)
+drone_cli_dependencies()
 ```
 
 Invoke with
 
 ```console
-bazel run //:drone-fmt
+bazel run @com_github_danmx_bazel_tools//drone-cli:run -- --help
 ```
diff --git a/drone-cli/def.bzl b/drone-cli/def.bzl
deleted file mode 100644
index e8f3a33..0000000
--- a/drone-cli/def.bzl
+++ /dev/null
@@ -1,12 +0,0 @@
-load("//run_in_workspace:def.bzl", "workspace_binary")
-
-def drone(
-        name,
-        args = None,
-        visibility = None):
-    workspace_binary(
-        name = name,
-        args = args,
-        visibility = visibility,
-        cmd = "@com_github_danmx_bazel_tools_drone-cli//:drone",
-    )
diff --git a/drone-cli/deps.bzl b/drone-cli/deps.bzl
index 55a1c43..e4c9b1e 100644
--- a/drone-cli/deps.bzl
+++ b/drone-cli/deps.bzl
@@ -1,57 +1,21 @@
-_VERSION = "v1.2.1"
-_BINARIES = {
-    "windows-amd64": {
-        "suffix": "windows_amd64.tar.gz",
-        "sha256": "58621ce64bbbb060d4eccccc71061bb9671fef7d1980c74200aae12a669810cb",
-    },
-    "linux-amd64": {
-        "suffix": "linux_amd64.tar.gz",
-        "sha256": "c28f724eb44ad756e550789824b9c73d4970da884966bc71552a281815c13f0a",
-    },
-    "linux-arm": {
-        "suffix": "linux_arm.tar.gz",
-        "sha256": "297ea83310a7da43d5b25b1ea88cd72c62b024197d58bcf7ab6e7f2b36d4f9eb",
-    },
-    "linux-arm64": {
-        "suffix": "linux_arm64.tar.gz",
-        "sha256": "31d3faf3cf9ffac1cacbd7695cfd1eadfc9695d6a08d789b0857298fbeacb386",
-    },
-    "darwin-amd64": {
-        "suffix": "darwin_amd64.tar.gz",
-        "sha256": "0b0028ed785c10455a4d67a099de4979cce7825bc97af91d7ebca61525766923",
-    },
-}
-_DOWNLOAD_URI = "https://github.com/drone/drone-cli/releases/download/{version}/drone_{suffix}"
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-def _drone_cli_download_impl(ctx):
-    if ctx.os.name == "linux":
-        arch = "linux-amd64"
-    elif ctx.os.name == "mac os x":
-        arch = "darwin-amd64"
-    else:
-        fail("Unsupported operating system: {}".format(ctx.os.name))
-
-    if arch not in _BINARIES:
-        fail("Unsupported arch {}".format(arch))
-
-    url = _DOWNLOAD_URI.format(version = _VERSION, suffix = _BINARIES.get(arch).get("suffix"))
-    sha256 = _BINARIES.get(arch).get("sha256")
-
-    ctx.template(
-        "BUILD.bazel",
-        Label("//drone-cli:drone.build.bazel"),
-        executable = False,
+def drone_cli_dependencies():
+    http_archive(
+        name = "drone-linux-amd64",
+        urls = ["https://github.com/drone/drone-cli/releases/download/v1.2.2/drone_linux_amd64.tar.gz"],
+        sha256 = "59969ed403cab2e8fada1caaf8132c23f5689fde1c7dd9a807cef8786ef25924",
+        build_file = "@com_github_danmx_bazel_tools//drone-cli:drone.BUILD",
     )
-    ctx.download_and_extract(
-        url = url,
-        sha256 = sha256,
+    http_archive(
+        name = "drone-darwin-amd64",
+        urls = ["https://github.com/drone/drone-cli/releases/download/v1.2.2/drone_darwin_amd64.tar.gz"],
+        sha256 = "73f96ad0a9f3038463a86408b231b80758e64aa4ce85534933d85ee718ae096c",
+        build_file = "@com_github_danmx_bazel_tools//drone-cli:drone.BUILD",
     )
-
-_drone_cli_download = repository_rule(
-    implementation = _drone_cli_download_impl,
-)
-
-def drone_cli_dependencies():
-    _drone_cli_download(
-        name = "com_github_danmx_bazel_tools_drone-cli",
+    http_archive(
+        name = "drone-windows-amd64",
+        urls = ["https://github.com/drone/drone-cli/releases/download/v1.2.2/drone_windows_amd64.tar.gz"],
+        sha256 = "8ae9bb0b07ced2536cc8c8c0e236d1d8ae08b53387e1139a470e2cd37076a3ca",
+        build_file = "@com_github_danmx_bazel_tools//drone-cli:drone.BUILD",
     )
diff --git a/drone-cli/drone.BUILD b/drone-cli/drone.BUILD
new file mode 100644
index 0000000..ee2cba7
--- /dev/null
+++ b/drone-cli/drone.BUILD
@@ -0,0 +1,4 @@
+exports_files(
+    ["drone"],
+    visibility = ["//visibility:public"],
+)
diff --git a/drone-cli/drone.build.bazel b/drone-cli/drone.build.bazel
deleted file mode 100644
index 842f53c..0000000
--- a/drone-cli/drone.build.bazel
+++ /dev/null
@@ -1 +0,0 @@
-exports_files(["drone"])
diff --git a/git-chglog/BUILD b/git-chglog/BUILD
index ffd0fb0..6712d84 100644
--- a/git-chglog/BUILD
+++ b/git-chglog/BUILD
@@ -1 +1,9 @@
-package(default_visibility = ["//visibility:public"])
+alias(
+    name = "run",
+    actual = select({
+        "@com_github_danmx_bazel_tools//bazel/platforms:linux-x86_64": "@git-chglog-linux-amd64//file:git-chglog",
+        "@com_github_danmx_bazel_tools//bazel/platforms:macos-x86_64": "@git-chglog-darwin-amd64//file:git-chglog",
+        "@com_github_danmx_bazel_tools//bazel/platforms:windows-x86_64": "@git-chglog-windows-amd64//file:git-chglog",
+    }),
+    visibility = ["//visibility:public"],
+)
diff --git a/git-chglog/README.md b/git-chglog/README.md
index 9fbfac8..ff72b37 100644
--- a/git-chglog/README.md
+++ b/git-chglog/README.md
@@ -23,22 +23,8 @@ load("@com_github_danmx_bazel_tools//git-chglog:deps.bzl", "git_chglog_dependenc
 git_chglog_dependencies()
 ```
 
-`BUILD.bazel` typically in the workspace root:
-
-```bzl
-load("@com_github_danmx_bazel_tools//git-chglog:def.bzl", "git_chglog")
-
-git_chglog(
-    name = "git_chglog",
-    args = [
-        "-o",
-        "CHANGELOG.md",
-    ],
-)
-```
-
 Invoke with
 
 ```console
-bazel run //:git_chglog
+bazel run @com_github_danmx_bazel_tools//git-chglog:run -- --help
 ```
diff --git a/git-chglog/def.bzl b/git-chglog/def.bzl
deleted file mode 100644
index 43a198c..0000000
--- a/git-chglog/def.bzl
+++ /dev/null
@@ -1,12 +0,0 @@
-load("//run_in_workspace:def.bzl", "workspace_binary")
-
-def git_chglog(
-        name,
-        args = None,
-        visibility = None):
-    workspace_binary(
-        name = name,
-        args = args,
-        visibility = visibility,
-        cmd = "@com_github_danmx_bazel_tools_git-chglog//:git-chglog",
-    )
diff --git a/git-chglog/deps.bzl b/git-chglog/deps.bzl
index 4e91eab..a3fa70c 100644
--- a/git-chglog/deps.bzl
+++ b/git-chglog/deps.bzl
@@ -1,63 +1,24 @@
-_VERSION = "0.9.1"
-_BINARIES = {
-    "windows-amd64": {
-        "suffix": "windows_amd64.exe",
-        "sha256": "d14da18c6008de0c240b75991368a137068c8a06d3d4c3c240ddc806fd7b9612",
-    },
-    "windows-386": {
-        "suffix": "windows_386.exe",
-        "sha256": "00971cd3718084f405002d9732ad8758469b04a059feae96f3a943a0706065dd",
-    },
-    "linux-amd64": {
-        "suffix": "linux_amd64",
-        "sha256": "dca7d683a45cf4f0a871735d9981de4e787ef86b82282e8adc813b8738d2c531",
-    },
-    "linux-386": {
-        "suffix": "linux_386",
-        "sha256": "25021b185b706e3f0b3cdc56e1f69e1263c5f0d157725e2df0965b31eb2240d8",
-    },
-    "darwin-amd64": {
-        "suffix": "darwin_amd64",
-        "sha256": "2023d82b5b505cf8ac4db20f096f439650554e80eb509fe080f5e81b6b477d3c",
-    },
-    "darwin-386": {
-        "suffix": "darwin_386",
-        "sha256": "02011ddcbb5f2c21ba71cbd3bbe978cf74362ba579f31f6178ff835addd9f097",
-    },
-}
-_DOWNLOAD_URI = "https://github.com/git-chglog/git-chglog/releases/download/{version}/git-chglog_{suffix}"
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 
-def _git_chglog_download_impl(ctx):
-    if ctx.os.name == "linux":
-        arch = "linux-amd64"
-    elif ctx.os.name == "mac os x":
-        arch = "darwin-amd64"
-    else:
-        fail("Unsupported operating system: {}".format(ctx.os.name))
-
-    if arch not in _BINARIES:
-        fail("Unsupported arch {}".format(arch))
-
-    url = _DOWNLOAD_URI.format(version = _VERSION, suffix = _BINARIES.get(arch).get("suffix"))
-    sha256 = _BINARIES.get(arch).get("sha256")
-
-    ctx.template(
-        "BUILD.bazel",
-        Label("//git-chglog:git-chglog.build.bazel"),
-        executable = False,
+def git_chglog_dependencies():
+    http_file(
+        name = "git-chglog-linux-amd64",
+        urls = ["https://github.com/git-chglog/git-chglog/releases/download/0.9.1/git-chglog_linux_amd64"],
+        sha256 = "dca7d683a45cf4f0a871735d9981de4e787ef86b82282e8adc813b8738d2c531",
+        executable = True,
+        downloaded_file_path = "git-chglog",
     )
-    ctx.download(
-        output = "git-chglog",
-        url = url,
-        sha256 = sha256,
+    http_file(
+        name = "git-chglog-darwin-amd64",
+        urls = ["https://github.com/git-chglog/git-chglog/releases/download/0.9.1/git-chglog_darwin_amd64"],
+        sha256 = "2023d82b5b505cf8ac4db20f096f439650554e80eb509fe080f5e81b6b477d3c",
         executable = True,
+        downloaded_file_path = "git-chglog",
     )
-
-_git_chglog_download = repository_rule(
-    implementation = _git_chglog_download_impl,
-)
-
-def git_chglog_dependencies():
-    _git_chglog_download(
-        name = "com_github_danmx_bazel_tools_git-chglog",
+    http_file(
+        name = "git-chglog-windows-amd64",
+        urls = ["https://github.com/git-chglog/git-chglog/releases/download/0.9.1/git-chglog_windows_amd64.exe"],
+        sha256 = "d14da18c6008de0c240b75991368a137068c8a06d3d4c3c240ddc806fd7b9612",
+        executable = True,
+        downloaded_file_path = "git-chglog",
     )
diff --git a/git-chglog/git-chglog.build.bazel b/git-chglog/git-chglog.build.bazel
deleted file mode 100644
index ac9a9f2..0000000
--- a/git-chglog/git-chglog.build.bazel
+++ /dev/null
@@ -1 +0,0 @@
-exports_files(["git-chglog"])
diff --git a/golangci-lint/BUILD b/golangci-lint/BUILD
index ffd0fb0..ea81bcf 100644
--- a/golangci-lint/BUILD
+++ b/golangci-lint/BUILD
@@ -1 +1,9 @@
-package(default_visibility = ["//visibility:public"])
+alias(
+    name = "run",
+    actual = select({
+        "@com_github_danmx_bazel_tools//bazel/platforms:linux-x86_64": "@golangci-lint-linux-amd64//:golangci-lint",
+        "@com_github_danmx_bazel_tools//bazel/platforms:macos-x86_64": "@golangci-lint-darwin-amd64//:golangci-lint",
+        "@com_github_danmx_bazel_tools//bazel/platforms:windows-x86_64": "@golangci-lint-windows-amd64//:golangci-lint",
+    }),
+    visibility = ["//visibility:public"],
+)
diff --git a/golangci-lint/README.md b/golangci-lint/README.md
index ff513fd..7a2f32e 100644
--- a/golangci-lint/README.md
+++ b/golangci-lint/README.md
@@ -18,27 +18,13 @@ git_repository(
     shallow_since = "<bla>",
 )
 
-load("@com_github_danmx_bazel_tools//golangci-lint:deps.bzl", "drone_dependencies")
+load("@com_github_danmx_bazel_tools//golangci-lint:deps.bzl", "golangci_lint_dependencies")
 
-drone_dependencies()
-```
-
-`BUILD.bazel` typically in the workspace root:
-
-```bzl
-load("@com_github_danmx_bazel_tools//golangci-lint:def.bzl", "golangci_lint")
-
-golangci_lint(
-    name = "lint",
-    args = [
-        "run",
-        "./...",
-    ],
-)
+golangci_lint_dependencies()
 ```
 
 Invoke with
 
 ```console
-bazel run //:lint
+bazel run @com_github_danmx_bazel_tools//golangci-lint:run -- --help
 ```
diff --git a/golangci-lint/def.bzl b/golangci-lint/def.bzl
deleted file mode 100644
index 74aacd0..0000000
--- a/golangci-lint/def.bzl
+++ /dev/null
@@ -1,12 +0,0 @@
-load("//run_in_workspace:def.bzl", "workspace_binary")
-
-def golangci_lint(
-        name,
-        args = None,
-        visibility = None):
-    workspace_binary(
-        name = name,
-        args = args,
-        visibility = visibility,
-        cmd = "@com_github_danmx_bazel_tools_golangci-lint//:golangci-lint",
-    )
diff --git a/golangci-lint/deps.bzl b/golangci-lint/deps.bzl
index 5b65601..999b87b 100644
--- a/golangci-lint/deps.bzl
+++ b/golangci-lint/deps.bzl
@@ -1,57 +1,24 @@
-_VERSION = "1.27.0"
-_BINARIES = {
-    "windows-amd64": {
-        "suffix": ".exe-{version}-windows-amd64.zip",
-        "sha256": "bf781f05b0d393b4bf0a327d9e62926949a4f14d7774d950c4e009fc766ed1d4",
-        "archive": "zip",
-    },
-    "linux-amd64": {
-        "suffix": "-{version}linux-amd64",
-        "sha256": "8d345e4e88520e21c113d81978e89ad77fc5b13bfdf20e5bca86b83fc4261272",
-        "archive": "tar.gz",
-    },
-    "darwin-amd64": {
-        "suffix": "-{version}-darwin-amd64",
-        "sha256": "3fb1a1683a29c6c0a8cd76135f62b606fbdd538d5a7aeab94af1af70ffdc2fd4",
-        "archive": "tar.gz",
-    },
-}
-_DOWNLOAD_URI = "https://github.com/golangci/golangci-lint/releases/download/v{version}/golangci-lint{suffix}.{archive}"
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-def _golangci_lint_download_impl(ctx):
-    if ctx.os.name == "linux":
-        arch = "linux-amd64"
-    elif ctx.os.name == "mac os x":
-        arch = "darwin-amd64"
-    else:
-        fail("Unsupported operating system: {}".format(ctx.os.name))
-
-    if arch not in _BINARIES:
-        fail("Unsupported arch {}".format(arch))
-
-    url = _DOWNLOAD_URI.format(
-        version = _VERSION,
-        suffix = _BINARIES.get(arch).get("suffix").format(version = _VERSION),
-        archive = _BINARIES.get(arch).get("archive"),
-    )
-    sha256 = _BINARIES.get(arch).get("sha256")
-
-    ctx.template(
-        "BUILD.bazel",
-        Label("//golangci-lint:golangci-lint.build.bazel"),
-        executable = False,
+def golangci_lint_dependencies():
+    http_archive(
+        name = "golangci-lint-linux-amd64",
+        urls = ["https://github.com/golangci/golangci-lint/releases/download/v1.31.0/golangci-lint-1.31.0-linux-amd64.tar.gz"],
+        sha256 = "9fff85f4649d17d18ebbcb775fec05de42a83e08787af1850f8f5f8dd4c066e9",
+        build_file = "@com_github_danmx_bazel_tools//golangci-lint:golangci-lint.BUILD",
+        strip_prefix = "golangci-lint-1.31.0-linux-amd64",
     )
-    ctx.download_and_extract(
-        url = url,
-        sha256 = sha256,
-        stripPrefix = "golangci-lint" + _BINARIES.get(arch).get("suffix").format(version = _VERSION),
+    http_archive(
+        name = "golangci-lint-darwin-amd64",
+        urls = ["https://github.com/golangci/golangci-lint/releases/download/v1.31.0/golangci-lint-1.31.0-darwin-amd64.tar.gz"],
+        sha256 = "f3afeb6ad6964615e2b238f56cc2e5b32464f2f302a4f3ccf5874a04170c287a",
+        build_file = "@com_github_danmx_bazel_tools//golangci-lint:golangci-lint.BUILD",
+        strip_prefix = "golangci-lint-1.31.0-darwin-amd64",
     )
-
-_golangci_lint_download = repository_rule(
-    implementation = _golangci_lint_download_impl,
-)
-
-def golangci_lint_dependencies():
-    _golangci_lint_download(
-        name = "com_github_danmx_bazel_tools_golangci-lint",
+    http_archive(
+        name = "golangci-lint-windows-amd64",
+        urls = ["https://github.com/golangci/golangci-lint/releases/download/v1.31.0/golangci-lint-1.31.0-windows-amd64.tar.gz"],
+        sha256 = "6ce6b1d3207a63256d82fbbac80bb9e85d7705ec1a408f005dfe324457c54966",
+        build_file = "@com_github_danmx_bazel_tools//golangci-lint:golangci-lint.BUILD",
+        strip_prefix = "golangci-lint-1.31.0-windows-amd64",
     )
diff --git a/golangci-lint/golangci-lint.BUILD b/golangci-lint/golangci-lint.BUILD
new file mode 100644
index 0000000..40d42d0
--- /dev/null
+++ b/golangci-lint/golangci-lint.BUILD
@@ -0,0 +1,4 @@
+exports_files(
+    ["golangci-lint"],
+    visibility = ["//visibility:public"],
+)
diff --git a/golangci-lint/golangci-lint.build.bazel b/golangci-lint/golangci-lint.build.bazel
deleted file mode 100644
index 6b35043..0000000
--- a/golangci-lint/golangci-lint.build.bazel
+++ /dev/null
@@ -1 +0,0 @@
-exports_files(["golangci-lint"])