diff --git a/BUILD b/BUILD
index e678db7015..79871d621c 100644
--- a/BUILD
+++ b/BUILD
@@ -1,10 +1,11 @@
 # Bazel (https://bazel.build/) BUILD file for Protobuf.
 
-load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_test", "objc_library")
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_test", "objc_library", native_cc_proto_library = "cc_proto_library")
 load("@rules_java//java:defs.bzl", "java_library")
 load("@rules_proto//proto:defs.bzl", "proto_lang_toolchain", "proto_library")
 load("@rules_proto//proto/private:native.bzl", "native_proto_common")
 load("@rules_python//python:defs.bzl", "py_library")
+load(":cc_proto_blacklist_test.bzl", "cc_proto_blacklist_test")
 
 licenses(["notice"])
 
@@ -315,6 +316,17 @@ cc_proto_library(
     deps = [dep + "_proto" for dep in proto[1][1]],
 ) for proto in WELL_KNOWN_PROTO_MAP.items()]
 
+[native_cc_proto_library(
+    name = proto + "_cc_proto",
+    deps = [proto + "_proto"],
+    visibility = ["//visibility:private"],
+) for proto in WELL_KNOWN_PROTO_MAP.keys()]
+
+cc_proto_blacklist_test(
+    name = "cc_proto_blacklist_test",
+    deps = [proto + "_cc_proto" for proto in WELL_KNOWN_PROTO_MAP.keys()]
+)
+
 ################################################################################
 # Protocol Buffers Compiler
 ################################################################################
@@ -989,7 +1001,7 @@ cc_library(
 
 # Note: We use `native_proto_common` here because we depend on an implementation-detail of
 # `proto_lang_toolchain`, which may not be available on `proto_common`.
-reject_blacklisted_files = not hasattr(native_proto_common, "proto_lang_toolchain_rejects_files_do_not_use_or_we_will_break_you_without_mercy")
+reject_blacklisted_files = hasattr(native_proto_common, "proto_lang_toolchain_rejects_files_do_not_use_or_we_will_break_you_without_mercy")
 cc_toolchain_blacklisted_protos = [proto + "_proto" for proto in WELL_KNOWN_PROTO_MAP.keys()] if reject_blacklisted_files else [":well_known_protos"]
 proto_lang_toolchain(
     name = "cc_toolchain",
diff --git a/WORKSPACE b/WORKSPACE
index aedc4e0729..39672c8828 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -76,3 +76,8 @@ bind(
     name = "error_prone_annotations",
     actual = "@error_prone_annotations_maven//jar",
 )
+
+# For `cc_proto_blacklist_test`.
+load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
+
+bazel_skylib_workspace()
diff --git a/cc_proto_blacklist_test.bzl b/cc_proto_blacklist_test.bzl
new file mode 100644
index 0000000000..df54293cbd
--- /dev/null
+++ b/cc_proto_blacklist_test.bzl
@@ -0,0 +1,38 @@
+"""Contains a unittest to verify that `cc_proto_library` does not generate code for blacklisted `.proto` sources (i.e. WKPs)."""
+
+load("@bazel_skylib//lib:unittest.bzl", "asserts", "unittest")
+
+def _cc_proto_blacklist_test_impl(ctx):
+    """Verifies that there are no C++ compile actions for Well-Known-Protos.
+
+    Args:
+      ctx: The rule context.
+
+    Returns: A (not further specified) sequence of providers.
+    """
+
+    env = unittest.begin(ctx)
+
+    for dep in ctx.attr.deps:
+        files = len(dep.files.to_list())
+        asserts.equals(
+            env,
+            0,
+            files,
+            "Expected that target '{}' does not provide files, got {}".format(
+                dep.label,
+                files,
+            ),
+        )
+
+    return unittest.end(env)
+
+cc_proto_blacklist_test = unittest.make(
+    impl = _cc_proto_blacklist_test_impl,
+    attrs = {
+        "deps": attr.label_list(
+            mandatory = True,
+            providers = [CcInfo],
+        ),
+    },
+)
diff --git a/kokoro/linux/bazel/build.sh b/kokoro/linux/bazel/build.sh
index b99b4d31df..b5991d773a 100755
--- a/kokoro/linux/bazel/build.sh
+++ b/kokoro/linux/bazel/build.sh
@@ -23,7 +23,10 @@ cd $(dirname $0)/../../..
 git submodule update --init --recursive
 
 trap print_test_logs EXIT
-bazel test :build_files_updated_unittest :protobuf_test --copt=-Werror --host_copt=-Werror
+bazel test --copt=-Werror --host_copt=-Werror \
+  //:build_files_updated_unittest \
+  //:protobuf_test \
+  @com_google_protobuf//:cc_proto_blacklist_test
 trap - EXIT
 
 cd examples
diff --git a/protobuf_deps.bzl b/protobuf_deps.bzl
index 9209b1c5a3..fb0c47786d 100644
--- a/protobuf_deps.bzl
+++ b/protobuf_deps.bzl
@@ -8,9 +8,11 @@ def protobuf_deps():
     if not native.existing_rule("bazel_skylib"):
         http_archive(
             name = "bazel_skylib",
-            sha256 = "bbccf674aa441c266df9894182d80de104cabd19be98be002f6d478aaa31574d",
-            strip_prefix = "bazel-skylib-2169ae1c374aab4a09aa90e65efe1a3aad4e279b",
-            urls = ["https://github.com/bazelbuild/bazel-skylib/archive/2169ae1c374aab4a09aa90e65efe1a3aad4e279b.tar.gz"],
+            sha256 = "97e70364e9249702246c0e9444bccdc4b847bed1eb03c5a3ece4f83dfe6abc44",
+            urls = [
+                "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/1.0.2/bazel-skylib-1.0.2.tar.gz",
+                "https://github.com/bazelbuild/bazel-skylib/releases/download/1.0.2/bazel-skylib-1.0.2.tar.gz",
+            ],
         )
 
     if not native.existing_rule("zlib"):