diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 37d5b8d7c..6d12bd124 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -109,6 +109,9 @@ jobs:
           # Don't test RBE with on Windows (not configured)
           - os: windows
             config: rbe
+          # Root workspace is bzlmod-only
+          - folder: .
+            bzlmod: 0
           # TODO: green up root Workspace on MacOS & Windows
           - folder: .
             os: macos
diff --git a/BUILD.bazel b/BUILD.bazel
index a1d463ddf..1b18b9792 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -1,13 +1,12 @@
 load("@aspect_bazel_lib_host//:defs.bzl", "host")
-load("@bazel_gazelle//:def.bzl", "DEFAULT_LANGUAGES", "gazelle", "gazelle_binary")
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@buildifier_prebuilt//:rules.bzl", "buildifier")
+load("@gazelle//:def.bzl", "DEFAULT_LANGUAGES", "gazelle", "gazelle_binary")
 load("//lib:diff_test.bzl", "diff_test")
 load("//lib:tar.bzl", "mtree_spec")
 load("//lib:testing.bzl", "assert_contains")
-load("//lib:utils.bzl", "is_bazel_7_or_greater")
 load("//lib:write_source_files.bzl", "write_source_files")
 load("//lib:yq.bzl", "yq")
 
@@ -71,16 +70,6 @@ alias(
     tags = ["manual"],  # tag as manual so windows ci does not build it by default
 )
 
-bzl_library(
-    name = "internal_deps",
-    srcs = ["internal_deps.bzl"],
-    visibility = ["//visibility:public"],
-    deps = [
-        "@bazel_tools//tools/build_defs/repo:http.bzl",
-        "@bazel_tools//tools/build_defs/repo:utils.bzl",
-    ] + (["@bazel_tools//tools/build_defs/repo:cache.bzl"] if is_bazel_7_or_greater() else []),
-)
-
 # write_source_files() to a git ignored subdirectory of the root
 genrule(
     name = "write_source_file_root",
@@ -135,7 +124,7 @@ bzl_library(
     name = "deps",
     srcs = ["deps.bzl"],
     visibility = ["//visibility:public"],
-    deps = ["@bazel_gazelle//:deps"],
+    deps = ["@gazelle//:deps"],
 )
 
 # Test case for mtree_spec: Ensure that multiple entries at the root directory are handled correctly (bug #851)
diff --git a/MODULE.bazel b/MODULE.bazel
index bef9552bd..94ad1243a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -24,7 +24,7 @@ bazel_lib_toolchains.tar()
 bazel_lib_toolchains.zstd()
 bazel_lib_toolchains.expand_template()
 bazel_lib_toolchains.bats()
-use_repo(bazel_lib_toolchains, "bats_toolchains", "bsd_tar_toolchains", "copy_directory_toolchains", "copy_to_directory_toolchains", "coreutils_toolchains", "expand_template_toolchains", "jq_toolchains", "yq_toolchains", "zstd_toolchains")
+use_repo(bazel_lib_toolchains, "bats_toolchains", "bsd_tar_toolchains", "copy_directory_toolchains", "copy_to_directory_toolchains", "coreutils_toolchains", "expand_template_toolchains", "jq", "jq_toolchains", "yq_toolchains", "zstd_toolchains")
 
 register_toolchains(
     "@copy_directory_toolchains//:all",
@@ -73,6 +73,7 @@ host = use_extension("@aspect_bazel_lib//lib:extensions.bzl", "host", dev_depend
 host.host()
 use_repo(host, "aspect_bazel_lib_host")
 
+bazel_dep(name = "aspect_rules_lint", version = "1.0.0-rc8", dev_dependency = True)
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.5.0", dev_dependency = True)
 bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
 bazel_dep(name = "bazel_features", version = "0.2.0", dev_dependency = True)
diff --git a/WORKSPACE b/WORKSPACE
deleted file mode 100644
index 252ab398d..000000000
--- a/WORKSPACE
+++ /dev/null
@@ -1,100 +0,0 @@
-# Declare the local Bazel workspace.
-# This is *not* included in the published distribution.
-workspace(
-    # see https://docs.bazel.build/versions/main/skylark/deploying.html#workspace
-    name = "aspect_bazel_lib",
-)
-
-load(":internal_deps.bzl", "bazel_lib_internal_deps")
-
-# Fetch deps needed only locally for development
-bazel_lib_internal_deps()
-
-load("@bazel_features//:deps.bzl", "bazel_features_deps")
-
-bazel_features_deps()
-
-load("@io_bazel_stardoc//:setup.bzl", "stardoc_repositories")
-
-stardoc_repositories()
-
-load("@rules_jvm_external//:repositories.bzl", "rules_jvm_external_deps")
-
-rules_jvm_external_deps()
-
-load("@rules_jvm_external//:setup.bzl", "rules_jvm_external_setup")
-
-rules_jvm_external_setup()
-
-load("@io_bazel_stardoc//:deps.bzl", "stardoc_external_deps")
-
-stardoc_external_deps()
-
-load("@stardoc_maven//:defs.bzl", stardoc_pinned_maven_install = "pinned_maven_install")
-
-stardoc_pinned_maven_install()
-
-load("//lib:repositories.bzl", "aspect_bazel_lib_dependencies", "aspect_bazel_lib_register_toolchains")
-
-aspect_bazel_lib_dependencies()
-
-aspect_bazel_lib_register_toolchains()
-
-# For running our own unit tests
-load("@bazel_skylib//lib:unittest.bzl", "register_unittest_toolchains")
-
-register_unittest_toolchains()
-
-# An external repository for test to use
-local_repository(
-    name = "external_test_repo",
-    path = "./lib/tests/external_test_repo",
-)
-
-load("//lib:host_repo.bzl", "host_repo")
-
-host_repo(name = "aspect_bazel_lib_host")
-
-############################################
-# rules_go
-
-load("//:deps.bzl", "go_dependencies")
-
-# gazelle:repository_macro deps.bzl%go_dependencies
-# gazelle:repository go_repository name=org_golang_x_tools importpath=golang.org/x/tools
-# https://github.com/bazelbuild/bazel-gazelle/issues/1217#issuecomment-1152236735
-go_dependencies()
-
-load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
-
-go_rules_dependencies()
-
-go_register_toolchains(version = "1.18.3")
-
-############################################
-# Gazelle, for generating bzl_library targets
-
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
-
-gazelle_dependencies()
-
-# Buildifier
-load("@buildifier_prebuilt//:deps.bzl", "buildifier_prebuilt_deps")
-
-buildifier_prebuilt_deps()
-
-load("@buildifier_prebuilt//:defs.bzl", "buildifier_prebuilt_register_toolchains")
-
-buildifier_prebuilt_register_toolchains()
-
-# rules_lint
-load(
-    "@aspect_rules_lint//format:repositories.bzl",
-    "fetch_shfmt",
-)
-
-fetch_shfmt()
-
-load("//.aspect/workflows:deps.bzl", "fetch_workflows_deps")
-
-fetch_workflows_deps()
diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
new file mode 100644
index 000000000..876b3821e
--- /dev/null
+++ b/WORKSPACE.bazel
@@ -0,0 +1,21 @@
+# An external repository for test to use
+local_repository(
+    name = "external_test_repo",
+    path = "./lib/tests/external_test_repo",
+)
+
+############################################
+# Go dependencies
+
+load("//:deps.bzl", "go_dependencies")
+
+# gazelle:repository_macro deps.bzl%go_dependencies
+# gazelle:repository go_repository name=org_golang_x_tools importpath=golang.org/x/tools
+# https://github.com/bazelbuild/bazel-gazelle/issues/1217#issuecomment-1152236735
+go_dependencies()
+
+############################################
+# Aspect Workflows
+load("//.aspect/workflows:deps.bzl", "fetch_workflows_deps")
+
+fetch_workflows_deps()
diff --git a/deps.bzl b/deps.bzl
index 50a4ba4e3..651bce7e7 100644
--- a/deps.bzl
+++ b/deps.bzl
@@ -1,7 +1,7 @@
 """This module contains the project repository dependencies.
 """
 
-load("@bazel_gazelle//:deps.bzl", "go_repository")
+load("@gazelle//:deps.bzl", "go_repository")
 
 def go_dependencies():
     """The Go dependencies.
diff --git a/e2e/copy_to_directory/WORKSPACE b/e2e/copy_to_directory/WORKSPACE
index e6dddf340..43071ef04 100644
--- a/e2e/copy_to_directory/WORKSPACE
+++ b/e2e/copy_to_directory/WORKSPACE
@@ -12,9 +12,19 @@ register_copy_to_directory_toolchains()
 ############################################
 # rules_go is needed to consume tools from sources
 
-load("@aspect_bazel_lib//:internal_deps.bzl", "bazel_lib_internal_deps")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-bazel_lib_internal_deps()
+http_archive(
+    name = "io_bazel_rules_go",
+    sha256 = "80a98277ad1311dacd837f9b16db62887702e9f1d1c4c9f796d0121a46c8e184",
+    urls = ["https://github.com/bazelbuild/rules_go/releases/download/v0.46.0/rules_go-v0.46.0.zip"],
+)
+
+http_archive(
+    name = "gazelle",
+    integrity = "sha256-dd8ojEsxyB61D1Hi4U9HY8t1SNquEmgXJHBkY3/Z6mI=",
+    urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.36.0/bazel-gazelle-v0.36.0.tar.gz"],
+)
 
 load("@aspect_bazel_lib//:deps.bzl", "go_dependencies")
 
@@ -26,6 +36,6 @@ go_rules_dependencies()
 
 go_register_toolchains(version = "1.18.3")
 
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+load("@gazelle//:deps.bzl", "gazelle_dependencies")
 
 gazelle_dependencies()
diff --git a/e2e/external_copy_to_directory/WORKSPACE b/e2e/external_copy_to_directory/WORKSPACE
index 8399ec11e..0c4ac39fb 100644
--- a/e2e/external_copy_to_directory/WORKSPACE
+++ b/e2e/external_copy_to_directory/WORKSPACE
@@ -5,14 +5,25 @@ local_repository(
     path = "../..",
 )
 
-load("@aspect_bazel_lib//:internal_deps.bzl", "bazel_lib_internal_deps")
-
-bazel_lib_internal_deps()
-
 load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
 
 aspect_bazel_lib_dependencies()
 
+# rules_go is needed to consume tools from sources
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "io_bazel_rules_go",
+    sha256 = "80a98277ad1311dacd837f9b16db62887702e9f1d1c4c9f796d0121a46c8e184",
+    urls = ["https://github.com/bazelbuild/rules_go/releases/download/v0.46.0/rules_go-v0.46.0.zip"],
+)
+
+http_archive(
+    name = "gazelle",
+    integrity = "sha256-dd8ojEsxyB61D1Hi4U9HY8t1SNquEmgXJHBkY3/Z6mI=",
+    urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.36.0/bazel-gazelle-v0.36.0.tar.gz"],
+)
+
 load("@aspect_bazel_lib//:deps.bzl", "go_dependencies")
 
 go_dependencies()
@@ -23,6 +34,6 @@ go_rules_dependencies()
 
 go_register_toolchains(version = "1.18.3")
 
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+load("@gazelle//:deps.bzl", "gazelle_dependencies")
 
 gazelle_dependencies()
diff --git a/e2e/external_copy_to_directory/app/WORKSPACE b/e2e/external_copy_to_directory/app/WORKSPACE
index 71e0edea8..ac056c9ad 100644
--- a/e2e/external_copy_to_directory/app/WORKSPACE
+++ b/e2e/external_copy_to_directory/app/WORKSPACE
@@ -8,14 +8,25 @@ local_repository(
     path = "../../..",
 )
 
-load("@aspect_bazel_lib//:internal_deps.bzl", "bazel_lib_internal_deps")
-
-bazel_lib_internal_deps()
-
 load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
 
 aspect_bazel_lib_dependencies()
 
+# rules_go is needed to consume tools from sources
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "io_bazel_rules_go",
+    sha256 = "80a98277ad1311dacd837f9b16db62887702e9f1d1c4c9f796d0121a46c8e184",
+    urls = ["https://github.com/bazelbuild/rules_go/releases/download/v0.46.0/rules_go-v0.46.0.zip"],
+)
+
+http_archive(
+    name = "gazelle",
+    integrity = "sha256-dd8ojEsxyB61D1Hi4U9HY8t1SNquEmgXJHBkY3/Z6mI=",
+    urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.36.0/bazel-gazelle-v0.36.0.tar.gz"],
+)
+
 load("@aspect_bazel_lib//:deps.bzl", "go_dependencies")
 
 go_dependencies()
@@ -26,6 +37,6 @@ go_rules_dependencies()
 
 go_register_toolchains(version = "1.18.3")
 
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+load("@gazelle//:deps.bzl", "gazelle_dependencies")
 
 gazelle_dependencies()
diff --git a/e2e/smoke/WORKSPACE b/e2e/smoke/WORKSPACE
index 85b270732..8f45d5ccb 100644
--- a/e2e/smoke/WORKSPACE
+++ b/e2e/smoke/WORKSPACE
@@ -9,12 +9,20 @@ aspect_bazel_lib_dependencies()
 
 aspect_bazel_lib_register_toolchains()
 
-############################################
 # rules_go is needed to consume tools from sources
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-load("@aspect_bazel_lib//:internal_deps.bzl", "bazel_lib_internal_deps")
+http_archive(
+    name = "io_bazel_rules_go",
+    sha256 = "80a98277ad1311dacd837f9b16db62887702e9f1d1c4c9f796d0121a46c8e184",
+    urls = ["https://github.com/bazelbuild/rules_go/releases/download/v0.46.0/rules_go-v0.46.0.zip"],
+)
 
-bazel_lib_internal_deps()
+http_archive(
+    name = "gazelle",
+    integrity = "sha256-dd8ojEsxyB61D1Hi4U9HY8t1SNquEmgXJHBkY3/Z6mI=",
+    urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.36.0/bazel-gazelle-v0.36.0.tar.gz"],
+)
 
 load("@aspect_bazel_lib//:deps.bzl", "go_dependencies")
 
@@ -26,6 +34,6 @@ go_rules_dependencies()
 
 go_register_toolchains(version = "1.18.3")
 
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+load("@gazelle//:deps.bzl", "gazelle_dependencies")
 
 gazelle_dependencies()
diff --git a/internal_deps.bzl b/internal_deps.bzl
deleted file mode 100644
index 54eda1f58..000000000
--- a/internal_deps.bzl
+++ /dev/null
@@ -1,71 +0,0 @@
-"""Our "development" dependencies
-
-Users should *not* need to install these. If users see a load()
-statement from these, that's a bug in our distribution.
-"""
-
-load("//lib:repositories.bzl", "register_bats_toolchains", "register_coreutils_toolchains", "register_jq_toolchains", "register_tar_toolchains", "register_yq_toolchains")
-load("//lib:utils.bzl", http_archive = "maybe_http_archive")
-
-# buildifier: disable=unnamed-macro
-def bazel_lib_internal_deps():
-    "Fetch deps needed for local development"
-    http_archive(
-        name = "io_bazel_rules_go",
-        sha256 = "80a98277ad1311dacd837f9b16db62887702e9f1d1c4c9f796d0121a46c8e184",
-        urls = ["https://github.com/bazelbuild/rules_go/releases/download/v0.46.0/rules_go-v0.46.0.zip"],
-    )
-
-    http_archive(
-        name = "bazel_gazelle",
-        integrity = "sha256-dd8ojEsxyB61D1Hi4U9HY8t1SNquEmgXJHBkY3/Z6mI=",
-        urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.36.0/bazel-gazelle-v0.36.0.tar.gz"],
-    )
-
-    http_archive(
-        name = "bazel_skylib_gazelle_plugin",
-        sha256 = "747addf3f508186234f6232674dd7786743efb8c68619aece5fb0cac97b8f415",
-        urls = ["https://github.com/bazelbuild/bazel-skylib/releases/download/1.5.0/bazel-skylib-gazelle-plugin-1.5.0.tar.gz"],
-    )
-
-    http_archive(
-        name = "bazel_skylib",
-        sha256 = "cd55a062e763b9349921f0f5db8c3933288dc8ba4f76dd9416aac68acee3cb94",
-        urls = ["https://github.com/bazelbuild/bazel-skylib/releases/download/1.5.0/bazel-skylib-1.5.0.tar.gz"],
-    )
-
-    http_archive(
-        name = "io_bazel_stardoc",
-        sha256 = "62bd2e60216b7a6fec3ac79341aa201e0956477e7c8f6ccc286f279ad1d96432",
-        urls = ["https://github.com/bazelbuild/stardoc/releases/download/0.6.2/stardoc-0.6.2.tar.gz"],
-    )
-
-    http_archive(
-        name = "buildifier_prebuilt",
-        sha256 = "8ada9d88e51ebf5a1fdff37d75ed41d51f5e677cdbeafb0a22dda54747d6e07e",
-        strip_prefix = "buildifier-prebuilt-6.4.0",
-        urls = ["http://github.com/keith/buildifier-prebuilt/archive/6.4.0.tar.gz"],
-    )
-
-    http_archive(
-        name = "aspect_rules_lint",
-        sha256 = "604666ec7ffd4f5f2636001ae892a0fbc29c77401bb33dd10601504e3ba6e9a7",
-        strip_prefix = "rules_lint-0.6.1",
-        url = "https://github.com/aspect-build/rules_lint/releases/download/v0.6.1/rules_lint-v0.6.1.tar.gz",
-    )
-
-    http_archive(
-        name = "bazel_features",
-        sha256 = "1aabce613b3ed83847b47efa69eb5dc9aa3ae02539309792a60e705ca4ab92a5",
-        strip_prefix = "bazel_features-0.2.0",
-        url = "https://github.com/bazel-contrib/bazel_features/releases/download/v0.2.0/bazel_features-v0.2.0.tar.gz",
-    )
-
-    # Register toolchains for tests
-    register_jq_toolchains()
-    register_yq_toolchains()
-    register_coreutils_toolchains()
-    register_tar_toolchains()
-    register_bats_toolchains(
-        libraries = ["@aspect_bazel_lib//lib/tests/bats/bats-custom:custom"],
-    )
diff --git a/tools/common/BUILD.bazel b/tools/common/BUILD.bazel
index 586868d54..9d7821828 100644
--- a/tools/common/BUILD.bazel
+++ b/tools/common/BUILD.bazel
@@ -12,10 +12,10 @@ go_library(
     visibility = ["//visibility:public"],
     deps = select({
         "@io_bazel_rules_go//go/platform:darwin": [
-            "@org_golang_x_sys//unix:go_default_library",
+            "@org_golang_x_sys//unix",
         ],
         "@io_bazel_rules_go//go/platform:ios": [
-            "@org_golang_x_sys//unix:go_default_library",
+            "@org_golang_x_sys//unix",
         ],
         "//conditions:default": [],
     }),
diff --git a/tools/format/BUILD.bazel b/tools/format/BUILD.bazel
index e66fce321..21b2f965e 100644
--- a/tools/format/BUILD.bazel
+++ b/tools/format/BUILD.bazel
@@ -1,27 +1,12 @@
-load("@aspect_rules_lint//format:defs.bzl", "multi_formatter_binary")
+load("@aspect_rules_lint//format:defs.bzl", "format_multirun")
 
-sh_binary(
-    name = "noop",
-    srcs = ["noop.sh"],
-)
-
-alias(
-    name = "shfmt",
-    actual = select({
-        "@bazel_tools//src/conditions:darwin_arm64": "@shfmt_darwin_aarch64//file:shfmt",
-        "@bazel_tools//src/conditions:darwin_x86_64": "@shfmt_darwin_x86_64//file:shfmt",
-        "@bazel_tools//src/conditions:linux_aarch64": "@shfmt_linux_aarch64//file:shfmt",
-        "@bazel_tools//src/conditions:linux_x86_64": "@shfmt_linux_x86_64//file:shfmt",
-        "//conditions:default": ":noop",
-    }),
-    visibility = ["//:__subpackages__"],
-)
-
-multi_formatter_binary(
+format_multirun(
     name = "format",
-    go = "@go_sdk//:bin/gofmt",
-    sh = ":shfmt",
+    # TODO: enable formatters in follow-up PR
+    # go = "@aspect_rules_lint//format:gofumpt",
+    # shell = "@aspect_rules_lint//format:shfmt",
     starlark = "@buildifier_prebuilt//:buildifier",
     tags = ["manual"],
     visibility = ["//:__subpackages__"],
+    # yaml = "@aspect_rules_lint//format:yamlfmt",
 )
diff --git a/tools/format/noop.sh b/tools/format/noop.sh
deleted file mode 100755
index 73acbcc8a..000000000
--- a/tools/format/noop.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-
-echo "not implemented".
-exit 1