diff --git a/.bazelrc b/.bazelrc
index 68940f90aa1d0cf01bdb1fea317ead3e3d41ae2c..19b7a9223a3ff7e133a11a146bab97619d5cf2b8 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -16,5 +16,8 @@ test --build_tests_only
 # Print relative paths where possible to reduce noise
 common --attempt_to_print_relative_paths
 
+# Disable warning transitive module versions
+common --check_direct_dependencies=off
+
 # User-specific .bazelrc
 try-import %workspace%/.bazelrc.user
diff --git a/.bazelrc.ci b/.bazelrc.ci
index 050689ff410a19cd6d2b86694252f54c890815ad..5e20333e0c1190804af189e7c0c3bbce1cde5405 100644
--- a/.bazelrc.ci
+++ b/.bazelrc.ci
@@ -26,8 +26,8 @@ test --test_output=errors
 test --test_verbose_timeout_warnings
 
 # Validate that the lockfile is correct
-common --lockfile_mode=error
+common --lockfile_mode=${CI_LOCKFILE_MODE}
 
 # These locations are cached on the CI
-build --disk_cache=${CI_PROJECT_DIR}/.cache/bazel/disk
-build --repository_cache=${CI_PROJECT_DIR}/.cache/bazel/repo
+build:local --disk_cache=${CI_PROJECT_DIR}/.cache/bazel/disk
+build:local --repository_cache=${CI_PROJECT_DIR}/.cache/bazel/repo
diff --git a/.bazelversion b/.bazelversion
index ae9a76b9249ada6741bd54810f9e944f1c7aaf74..cd1d2e94f31d7c63aa19967c2627230038786a10 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-8.0.0
+8.0.1
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ff89245ef66a972b1b1dd4a633b038a748efbcae..2494bb32fd75f199bcda9493a02d1e58773b0fc5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,20 +1,18 @@
 include:
-  - component: "${CI_SERVER_HOST}/ci/component/bazelisk/bazelisk@v1.0.1"
+  - component: "${CI_SERVER_HOST}/ci/component/bazelisk/ruleset@v1.2.1"
+    inputs:
+      versions:
+        - last_rc
+      oses:
+        - linux
+      configs:
+        - local
+      roots:
+        - .
+      extends:
+        - .base
 
-default:
-  tags:
-    - arm64
-
-.job:
-  extends: .bazelisk
-  cache:
-    - !reference [.bazelisk, cache]
-    - key: "bazel-cache-${CI_RUNNER_EXECUTABLE_ARCH}-${CI_PROJECT_ID}"
-      paths:
-        - ".cache/bazel/disk"
-        - ".cache/bazel/repo"
-
-test:
+.base:
   extends: .job
   before_script:
     - !reference [.job, before_script]
@@ -23,29 +21,7 @@ test:
     - cp "${CI_SSH_KNOWN_HOSTS}" "${HOME}/.ssh/known_hosts"
     - chmod -R 600 "${HOME}/.ssh"
 
-# TODO: switch this out for `rules_semantic_release`
-semantic-release:
-  extends: .job
-  stage: .post
-  image: node:lts
-  needs:
-    - test
-  cache:
-    - key:
-        prefix: "node"
-        files:
-          - package-lock.json
-      paths:
-        - node_modules
-        - .cache/npm
-    - !reference [.job, cache]
-  before_script:
-    - !reference [.job, before_script]
-    - npm config --location project set cache "${CI_PROJECT_DIR}/.cache/npm"
-    - npm ci --prefer-offline
-  script:
-    - npx semantic-release
-  rules:
-    - if: $CI_COMMIT_TAG
-      when: never
-    - if: $CI_COMMIT_REF_PROTECTED == "true"
+default:
+  tags:
+    - arm64
+    - linux