diff --git a/.bazelrc b/.bazelrc
index 95be903..1d053c7 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -9,5 +9,5 @@ test --noincompatible_strict_action_env
 build:ci --repo_env=CC=clang
 build:ci --features=layering_check
 
-# Requires Bazel 5.
-build:bzlmod --experimental_enable_bzlmod
+build:bzlmod --enable_bzlmod
+build:workspace --noexperimental_enable_bzlmod
diff --git a/.github/workflows/check-formatting.yml b/.github/workflows/check-formatting.yml
index eefecf9..10eaf52 100644
--- a/.github/workflows/check-formatting.yml
+++ b/.github/workflows/check-formatting.yml
@@ -19,7 +19,7 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@v2
         with:
-          go-version: '^1.15.5'
+          go-version: '^1.22'
 
       - name: Install formatters
         run: |
diff --git a/.github/workflows/run-tests-externally.yml b/.github/workflows/run-tests-externally.yml
index 083d6f8..200dc8a 100644
--- a/.github/workflows/run-tests-externally.yml
+++ b/.github/workflows/run-tests-externally.yml
@@ -19,33 +19,41 @@ jobs:
       matrix:
         bazel: [5.0.0, latest, last_green]
         bazel_mode: [workspace, module]
-        os: [ubuntu-latest, macos-latest, windows-2019]
-        jdk: [8, 11, 17]
+        os: [ubuntu-latest, macos-13, macos-latest, windows-2022]
+        jdk: [8, 11, 17, 21]
         exclude:
           - bazel: 5.0.0
             jdk: 11
           - bazel: 5.0.0
             jdk: 17
+          - bazel: 5.0.0
+            jdk: 21
           - bazel: 5.0.0
             bazel_mode: module
           - bazel: last_green
             jdk: 8
           - bazel: last_green
             jdk: 11
-          - bazel_mode: module
-            jdk: 8
-          - bazel_mode: module
-            jdk: 11
+          - bazel: last_green
+            jdk: 17
+          - bazel_mode: workspace
+            jdk: 17
+          - bazel_mode: workspace
+            jdk: 21
         include:
           - os: ubuntu-latest
             cache: "/home/runner/.cache/bazel-disk"
+          - os: macos-13
+            cache: "/private/var/tmp/bazel-disk"
           - os: macos-latest
             cache: "/private/var/tmp/bazel-disk"
             bazel_macos_args: "--xcode_version_config=//.github:host_xcodes"
-          - os: windows-2019
+          - os: windows-2022
             cache: "C:\\tmp\\bazel-disk"
           - bazel_mode: module
             bazel_extra_args: "--config=bzlmod"
+          - bazel_mode: module
+            bazel_extra_args: "--config=workspace"
     name: Test externally (${{ matrix.os }}, Bazel ${{ matrix.bazel }} ${{ matrix.bazel_mode }}, JDK ${{ matrix.jdk }})
     env:
       BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -76,7 +84,7 @@ jobs:
         run: bazelisk test --config=ci --disk_cache=${{ matrix.cache }} --profile=${{ github.workspace }}/profile.gz ${{ matrix.bazel_extra_args }} ${{ matrix.bazel_macos_args }} //...
 
       - name: Check coverage
-        if: ${{ (matrix.os == 'ubuntu-latest') && (matrix.jdk == '11') }}
+        if: ${{ (matrix.os == 'ubuntu-latest') && (matrix.jdk == '17') }}
         env:
           USE_BAZEL_VERSION: ${{ matrix.bazel }}
         working-directory: ./tests
diff --git a/.github/workflows/run-tests-internally.yml b/.github/workflows/run-tests-internally.yml
index 2cb03fa..6b2b8da 100644
--- a/.github/workflows/run-tests-internally.yml
+++ b/.github/workflows/run-tests-internally.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    name: Build and test internally (ubuntu-latest, Bazel last_green workspace, JDK 17)
+    name: Build and test internally (ubuntu-latest, Bazel last_green workspace, JDK 21)
 
     steps:
       - uses: actions/checkout@v2
@@ -24,7 +24,7 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@v1
         with:
-          java-version: 17
+          java-version: 21
 
       - name: Mount Bazel disk cache
         uses: actions/cache@v2
diff --git a/.gitignore b/.gitignore
index d3ca90c..a6339ce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 .ijwb
 .clwb
+.vscode
 bazel-*
+MODULE.bazel.lock
diff --git a/tests/analysis/cc_jni_library/tests.bzl b/tests/analysis/cc_jni_library/tests.bzl
index 291e1f4..47ec5ff 100644
--- a/tests/analysis/cc_jni_library/tests.bzl
+++ b/tests/analysis/cc_jni_library/tests.bzl
@@ -87,9 +87,11 @@ def _get_host_constraint_value(constraint_setting):
 
 def _get_host_legacy_cpu():
     cpu = _get_host_constraint_value("cpu")
-    if cpu != "x86_64":
-        fail("This test requires the host CPU to be x86_64, got: %s" % cpu)
     os = _get_host_constraint_value("os")
+    if os == "osx" and cpu == "aarch64":
+        return "darwin_arm64"
+    if cpu != "x86_64":
+        fail("This test requires the host CPU to be x86_64 or darwin_arm64, got: %s" % cpu)
     if os == "linux":
         return "k8"
     elif os == "osx":
diff --git a/tests/verify_coverage.sh b/tests/verify_coverage.sh
index d81fef4..03515c6 100755
--- a/tests/verify_coverage.sh
+++ b/tests/verify_coverage.sh
@@ -13,6 +13,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+set -euo pipefail
+
 report=bazel-out/_coverage/_coverage_report.dat
 
 find native_loader/src/main libjvm_stub -type f \