diff --git a/.bazelrc b/.bazelrc
index c2cb371657a2d..d99407bb7a820 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -31,10 +31,6 @@ build:ubsan --copt=-fno-sanitize=function --copt=-fno-sanitize=vptr
 # Abseil passes nullptr to memcmp with 0 size
 build:ubsan --copt=-fno-sanitize=nonnull-attribute
 
-# TODO: migrate all dependencies from WORKSPACE to MODULE.bazel
-# https://github.com/protocolbuffers/protobuf/issues/14313
-common --noenable_bzlmod
-
 # Important: this flag ensures that we remain compliant with the C++ layering
 # check.
 build --features=layering_check
diff --git a/.github/workflows/staleness_check.yml b/.github/workflows/staleness_check.yml
index 5cb0fbe30c38d..f0f0357753d9d 100644
--- a/.github/workflows/staleness_check.yml
+++ b/.github/workflows/staleness_check.yml
@@ -57,7 +57,7 @@ jobs:
             set -ex;
             echo "Please run ./regenerate_stale_files.sh to regenerate stale files";
             if [[ -z $COMMIT_TRIGGERED_RUN || -z $MAIN_RUN ]]; then
-            bazel query 'attr(tags, "staleness_test", //...)' | xargs bazel test $BAZEL_FLAGS;
+            bazel query 'attr(tags, "staleness_test", //...)' --noenable_bzlmod| xargs bazel test $BAZEL_FLAGS;
             else
-            bazel query 'attr(tags, "staleness_test", //...)';
+            bazel query 'attr(tags, "staleness_test", //...)' --noenable_bzlmod;
             fi
diff --git a/.github/workflows/test_bazel.yml b/.github/workflows/test_bazel.yml
index d824c5c32b6b8..992a2d314ff7b 100644
--- a/.github/workflows/test_bazel.yml
+++ b/.github/workflows/test_bazel.yml
@@ -58,4 +58,4 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: examples
           version: ${{ matrix.bazelversion }}
-          bash: cd examples && bazel build //... $BAZEL_FLAGS --enable_bzlmod=${{ matrix.bzlmod }} ${{ matrix.toolchain_resolution }}
+          bash: cd examples && bazel build //... $BAZEL_FLAGS --enable_bzlmod=${{ matrix.bzlmod }} --enable_workspace=${{ !matrix.bzlmod }} ${{ matrix.toolchain_resolution }}
diff --git a/.github/workflows/test_cpp.yml b/.github/workflows/test_cpp.yml
index c88eae04cd836..e1d41faa0cf2a 100644
--- a/.github/workflows/test_cpp.yml
+++ b/.github/workflows/test_cpp.yml
@@ -45,7 +45,7 @@ jobs:
             cache_key: Bazel7
             image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75"
             targets: "//src/... //third_party/utf8_range/..."
-          - config: { name: "Bazel7 with Bzlmod", flags: --enable_bzlmod --enable_workspace --cxxopt="-Wno-self-assign-overloaded" }
+          - config: { name: "Bazel7 with Bzlmod", flags: --cxxopt="-Wno-self-assign-overloaded" }
             cache_key: Bazel7bzlmod
             image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75"
             targets: "//src/... //third_party/utf8_range/..."
diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml
index 4f444bb6deb9d..73b7de7fad966 100644
--- a/.github/workflows/test_java.yml
+++ b/.github/workflows/test_java.yml
@@ -31,6 +31,7 @@ jobs:
           - name: OpenJDK 8
             cache_key: '8'
             image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:7.1.2-8-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
+            # TODO: https://github.com/protocolbuffers/protobuf/actions/runs/12470144355/job/34804726816?pr=19764
             # TODO: b/318555165 - enable the layering check. Currently it does
             # not work correctly with the toolchain in this Docker image.
             targets: //java/... //java/internal:java_version //compatibility/... --features=-layering_check
@@ -53,7 +54,6 @@ jobs:
             cache_key: 'bazel7bzlmod'
             image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75
             targets: //java/... //java/internal:java_version //compatibility/...
-            flags: --enable_bzlmod --enable_workspace
           - name: aarch64
             cache_key: 'aarch64'
             image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:7.1.2-aarch64-2920199ab0090ed427413a8e422e62695c8392a8
@@ -109,9 +109,10 @@ jobs:
         image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:7.1.2-11-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
         bazel-cache: java_linux/11
+        # Bash overrides the docker image's custom entrypoint
         bash: |
           set -ex
-          bazel build //java:release $BAZEL_FLAGS
+          /entrypoint.sh build //java:release $BAZEL_FLAGS
           mvn install:install-file -Dfile=java/bom/pom.xml -DpomFile=java/bom/pom.xml
           mvn install:install-file -Dfile=java/pom.xml -DpomFile=java/pom.xml
           mvn install:install-file -Dfile=bazel-bin/java/core/core_mvn-project.jar -DpomFile=bazel-bin/java/core/core_mvn-pom.xml
diff --git a/.github/workflows/test_python.yml b/.github/workflows/test_python.yml
index faf6dcdbb139c..b5fd1ca40ba18 100644
--- a/.github/workflows/test_python.yml
+++ b/.github/workflows/test_python.yml
@@ -29,6 +29,9 @@ jobs:
       matrix:
         type: [ Pure, C++]
         version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        # ERROR: error loading package 'python/dist': cannot load '@@rules_python~~python~python_3_12//:version.bzl': no such file
+        # https://github.com/protocolbuffers/protobuf/actions/runs/12470144355/job/34804733978?pr=19764
+        bzlmod: [false]
         include:
           - type: Pure
             targets: //python/... //python:python_version_test
@@ -50,6 +53,8 @@ jobs:
           - version: "3.12"
             continuous-only: true
           - version: "3.13"
+          - bzlmod: false
+            bzlmod-flags: --noenable_bzlmod
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.type }} ${{ matrix.version }}
     runs-on: ubuntu-latest
@@ -66,7 +71,7 @@ jobs:
           image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/python:7.1.2-{0}-d9624f2aa83cba3eaf906f751d75b36aacb9aa82', matrix.version) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: python_linux/${{ matrix.type }}_${{ matrix.version }}
-          bazel: test ${{ matrix.targets }} ${{ matrix.flags }} --test_env=KOKORO_PYTHON_VERSION
+          bazel: test ${{ matrix.targets }} ${{ matrix.flags }} ${{ matrix.bzlmod-flags }} --test_env=KOKORO_PYTHON_VERSION
           exclude-targets: -//python/pb_unit_tests/...
 
 
@@ -76,6 +81,7 @@ jobs:
       matrix:
         type: [ Pure, C++]
         version: [ "3.12", "3.13" ]
+        bzlmod: [false]
         include:
           - type: Pure
             targets: //python/... //python:python_version_test
@@ -84,6 +90,8 @@ jobs:
             flags: --define=use_fast_cpp_protos=true
           - version: "3.13"
             continuous-only: true
+          - bzlmod: false
+            bzlmod-flags: --noenable_bzlmod
 
     name: MacOS ${{ matrix.type }} ${{ matrix.version }}
     runs-on: macos-13
@@ -117,7 +125,7 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: python_macos/${{ matrix.type }}_${{ matrix.version }}
           bazel: >-
-            test ${{ matrix.targets }} ${{ matrix.flags }}
+            test ${{ matrix.targets }} ${{ matrix.flags }} ${{ matrix.bzlmod-flags }}
             --test_env=KOKORO_PYTHON_VERSION=${{ matrix.version }}
             --macos_minimum_os=11.0
           exclude-targets: -//python/pb_unit_tests/...
diff --git a/.github/workflows/test_ruby.yml b/.github/workflows/test_ruby.yml
index 93746ceddc831..aed04cc837715 100644
--- a/.github/workflows/test_ruby.yml
+++ b/.github/workflows/test_ruby.yml
@@ -200,11 +200,11 @@ jobs:
           image: us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:7.1.2-${{ matrix.ruby }}-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_install/${{ matrix.ruby }}_${{ matrix.bazel }}
+          # Bash overrides the docker image's custom entrypoint
           bash: >
             bazel --version;
             ruby --version;
-            ./regenerate_stale_files.sh $BAZEL_FLAGS;
-            bazel build //ruby:release //:protoc ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled' || '' }} $BAZEL_FLAGS;
+            ./entrypoint.sh build //ruby:release //:protoc ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled' || '' }} $BAZEL_FLAGS;
             gem install bazel-bin/ruby/google-protobuf-*;
             bazel-bin/protoc --proto_path=src --proto_path=ruby/tests --proto_path=ruby --ruby_out=ruby tests/test_import_proto2.proto;
             bazel-bin/protoc --proto_path=src --proto_path=ruby/tests --proto_path=ruby --ruby_out=ruby tests/basic_test.proto;
diff --git a/.github/workflows/test_upb.yml b/.github/workflows/test_upb.yml
index 2edc19d22917f..8485503ce02f8 100644
--- a/.github/workflows/test_upb.yml
+++ b/.github/workflows/test_upb.yml
@@ -52,7 +52,7 @@ jobs:
           image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:${{ matrix.config.bazel_version || '7.1.2' }}-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: upb-bazel
-          bazel: test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/... ${{ matrix.config.flags }}
+          bazel: test --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/... ${{ matrix.config.flags }}
           exclude-targets: ${{ matrix.config.exclude-targets }}
 
   linux-gcc:
@@ -72,7 +72,7 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-gcc"
           bazel: >-
-            test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 -c opt
+            test --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 -c opt
             --copt="-Wno-error=maybe-uninitialized" --copt="-Wno-error=attributes"
             //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
 
@@ -96,7 +96,7 @@ jobs:
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-windows"
-          bazel: test --cxxopt=/std:c++17 --host_cxxopt=/std:c++17 //upb/... //upb_generator/... //python/...
+          bazel: test --noenable_bzlmod --cxxopt=/std:c++17 --host_cxxopt=/std:c++17 //upb/... //upb_generator/... //python/...
           version: 7.1.2
           exclude-targets: -//python:conformance_test -//upb/reflection:def_builder_test
 
@@ -125,7 +125,7 @@ jobs:
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-macos"
-          bazel: ${{ matrix.config.bazel-command }} --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 ${{ matrix.config.flags }} //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
+          bazel: ${{ matrix.config.bazel-command }} --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 ${{ matrix.config.flags }} //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
           version: 7.1.2
 
   no-python:
@@ -148,7 +148,7 @@ jobs:
             which python3 &&
             mv `which python3` /tmp &&
             ! which python3 &&
-            bazel test $BAZEL_FLAGS --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //python/... -- -//python/dist:source_wheel -//python:aarch64_test -//python:x86_64_test -//python:google/protobuf/pyext/_message.so -//python:proto_api
+            bazel test $BAZEL_FLAGS --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //python/... -- -//python/dist:source_wheel -//python:aarch64_test -//python:x86_64_test -//python:google/protobuf/pyext/_message.so -//python:proto_api
 
   build_wheels:
     name: Build Wheels
@@ -165,7 +165,7 @@ jobs:
           image: us-docker.pkg.dev/protobuf-build/release-containers/linux/apple:7.1.2-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: upb-bazel-python
-          bazel: build --crosstool_top=//toolchain:clang_suite --//toolchain:release=true --symlink_prefix=/ -c dbg --incompatible_enable_cc_toolchain_resolution=false //python/dist //python/dist:test_wheel //python/dist:source_wheel
+          bazel: build --noenable_bzlmod --crosstool_top=//toolchain:clang_suite --//toolchain:release=true --symlink_prefix=/ -c dbg --incompatible_enable_cc_toolchain_resolution=false //python/dist //python/dist:test_wheel //python/dist:source_wheel
       - name: Move Wheels
         run: mkdir wheels && find _build/out \( -name 'protobuf*.whl' -o -name 'protobuf-*.tar.gz' \) -exec mv '{}' wheels ';'
       - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
diff --git a/MODULE.bazel b/MODULE.bazel
index 74a215ac5f564..b0bb58df7cd54 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -15,6 +15,7 @@ module(
 bazel_dep(name = "abseil-cpp", version = "20240722.0", repo_name = "com_google_absl")
 bazel_dep(name = "bazel_skylib", version = "1.7.0")
 bazel_dep(name = "jsoncpp", version = "1.9.6")
+bazel_dep(name = "rules_apple", version = "3.13.0", repo_name = "build_bazel_rules_apple")
 bazel_dep(name = "apple_support", version = "1.15.1", repo_name = "build_bazel_apple_support")
 bazel_dep(name = "rules_cc", version = "0.0.16")
 bazel_dep(name = "rules_fuzzing", version = "0.5.2")
@@ -85,7 +86,7 @@ use_repo(crate, crate_index = "crates")
 
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven", dev_dependency = True)
 maven.install(
-    name = "protobuf_maven",
+    name = "maven",
     artifacts = [
         "com.google.caliper:caliper:1.0-beta-3",
         "com.google.code.findbugs:jsr305:3.0.2",
@@ -106,7 +107,7 @@ maven.install(
         "https://repo.maven.apache.org/maven2",
     ],
 )
-use_repo(maven, "protobuf_maven")
+use_repo(maven, protobuf_maven = "maven")
 
 # Development dependencies
 bazel_dep(name = "googletest", version = "1.14.0", dev_dependency = True, repo_name = "com_google_googletest")
diff --git a/WORKSPACE.bzlmod b/WORKSPACE.bzlmod
index a3dd8925a198e..de94c1f584539 100644
--- a/WORKSPACE.bzlmod
+++ b/WORKSPACE.bzlmod
@@ -21,8 +21,22 @@ ruby_runtime("system_ruby")
 
 register_toolchains("@system_ruby//:toolchain")
 
+load("@system_ruby//:bundle.bzl", "ruby_bundle")
+
+ruby_bundle(
+    name = "protobuf_bundle",
+    srcs = ["//ruby:google-protobuf.gemspec"],
+    gemfile = "//ruby:Gemfile",
+)
+
 # Following are just needed to run conformance tests, not really needed to support them via MODULE.bazel
 
+# For testing from another repo.
+local_repository(
+    name = "com_google_protobuf_examples",
+    path = "examples",
+)
+
 # For testing runtime against old gencode from a previous major version.
 http_archive(
     name = "com_google_protobuf_v25.0",
@@ -34,7 +48,6 @@ http_archive(
 load("@com_google_protobuf_v25.0//:protobuf_deps.bzl", protobuf_v25_deps="protobuf_deps")
 protobuf_v25_deps()
 
-
 # Needed for checking breaking changes from the previous release version.
 load("//:protobuf_version.bzl", "PROTOBUF_PREVIOUS_RELEASE")
 
diff --git a/ci/common.bazelrc b/ci/common.bazelrc
index a5f37ae1ccbaa..b616d61e98d84 100644
--- a/ci/common.bazelrc
+++ b/ci/common.bazelrc
@@ -76,10 +76,6 @@ build --incompatible_use_host_features
 #   --incompatible_fail_on_unknown_attributes
 #   --incompatible_merge_fixed_and_default_shell_env
 
-# TODO: migrate all dependencies from WORKSPACE to MODULE.bazel
-# https://github.com/protocolbuffers/protobuf/issues/14313
-common --noenable_bzlmod
-
 # For easier debugging of build failures.
 common --announce_rc
 build --verbose_failures
diff --git a/ci/macOS.bazelrc b/ci/macOS.bazelrc
index 370a039d74325..3a3c10ab506ec 100644
--- a/ci/macOS.bazelrc
+++ b/ci/macOS.bazelrc
@@ -3,7 +3,7 @@ import common.bazelrc
 build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
 build --cxxopt="-Woverloaded-virtual"
 build --copt="-Wpointer-arith"
-build --copt="-Werror" --copt="-Wno-sign-compare" --copt="-Wno-sign-conversion" --copt="-Wno-error=sign-conversion" --copt="-Wno-deprecated-declarations"
+build --copt="-Werror" --copt="-Wno-sign-compare" --copt="-Wno-sign-conversion" --copt="-Wno-error=sign-conversion" --copt="-Wno-deprecated-declarations" --copt="-Wno-unknown-warning-option"
 common --xcode_version_config=@com_google_protobuf//.github:host_xcodes
 
 build --apple_crosstool_top=@local_config_apple_cc//:toolchain
diff --git a/regenerate_stale_files.sh b/regenerate_stale_files.sh
index 863a514948c8b..6cba085faa02a 100755
--- a/regenerate_stale_files.sh
+++ b/regenerate_stale_files.sh
@@ -30,7 +30,7 @@ STALENESS_TESTS=(
 
 # Run and fix all staleness tests.
 for test in ${STALENESS_TESTS[@]}; do
-  ${BazelBin} test $test "$@" || ./bazel-bin/${test%%:*}/${test#*:} --fix
+  ${BazelBin} test $test "$@" || ./bazel-bin/${test%%:*}/${test#*:} --fix --noenable_bzlmod
 done
 
 # Generate C# code.