diff --git a/.github/workflows/test_cpp.yml b/.github/workflows/test_cpp.yml
index 0aef03db08..a6dd8b8c02 100644
--- a/.github/workflows/test_cpp.yml
+++ b/.github/workflows/test_cpp.yml
@@ -30,6 +30,9 @@ jobs:
           - targets: //pkg/... //src/... @com_google_protobuf_examples//... //third_party/utf8_range/...
 
           # Override cases with custom images
+          - config: { name: "Bazel7" }
+            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.0.0-a04396cc76704d4b7c722789e9c08df18f47df53"
+            targets: "//src/... //third_party/utf8_range/..."
           - config: { name: "TCMalloc" }
             image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc@sha256:bd39119d74b8a3fad4ae335d4cf5294e70384676331b7e19949459fc7a8d8328"
             targets: "//src/... //third_party/utf8_range/..."
@@ -313,21 +316,32 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         include:
-          - name: MacOS
+          - name: MacOS Bazel
             os: macos-12
             cache_key: macos-12
             bazel: test //src/... //third_party/utf8_range/...
-          - name: MacOS Apple Silicon (build only)
+          # TODO Enable these once mac setup is working for Bazel 7
+          #- name: MacOS Bazel 7
+          #  os: macos-12
+          #  cache_key: macos-12-bazel7
+          #  bazel: test //src/... //third_party/utf8_range/...
+          #  bazel_version: '7.0.0'
+          - name: MacOS Apple Silicon (build only) Bazel
             os: macos-12
             cache_key: macos-12-arm
             # Current github runners are all Intel based, so just build/compile
             # for Apple Silicon to detect issues there.
             bazel: build --cpu=darwin_arm64 //src/... //third_party/utf8_range/...
-          - name: Windows
+          - name: Windows Bazel
             os: windows-2022
             cache_key: windows-2022
             bazel: test //src/...  @com_google_protobuf_examples//... --test_tag_filters=-conformance --build_tag_filters=-conformance
-    name: ${{ matrix.name }} Bazel
+          - name: Windows Bazel 7
+            os: windows-2022
+            cache_key: windows-2022-bazel7
+            bazel: test //src/...  @com_google_protobuf_examples//... --test_tag_filters=-conformance --build_tag_filters=-conformance
+            bazel_version: '7.0.0'
+    name: ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout pending changes
@@ -340,6 +354,7 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel: ${{ matrix.bazel }}
           bazel-cache: cpp_${{ matrix.cache_key }}
+          version: ${{ matrix.bazel_version || '6.3.0' }}
 
   non-linux-cmake:
     strategy:
diff --git a/.github/workflows/test_upb.yml b/.github/workflows/test_upb.yml
index e819c377c3..a6d7f19418 100644
--- a/.github/workflows/test_upb.yml
+++ b/.github/workflows/test_upb.yml
@@ -17,6 +17,7 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         config:
+          - { name: "Bazel 7", bazel_version: "7.0.0" }
           - { name: "Fastbuild" }
           - { name: "Optimized", flags: "-c opt" }
           - { name: "FastTable", flags: "--//upb:fasttable_enabled=true" }
@@ -37,7 +38,7 @@ jobs:
       - name: Run tests
         uses: protocolbuffers/protobuf-ci/bazel-docker@v2
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize@sha256:04cd765285bc52cbbf51d66c8c66d8603579cf0f19cc42df26b09d2c270541fb
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:${{ matrix.config.bazel_version || '6.3.0' }}-d07b7d649401d147e71e7182d2832cc8344f1f35
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: upb-bazel
           bazel: test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //bazel/... //benchmarks/... //lua/... //protos/... //protos_generator/... //python/... //upb/... //upb_generator/... ${{ matrix.config.flags }}
@@ -81,6 +82,7 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-windows"
           bazel: test --cxxopt=/std:c++17 --host_cxxopt=/std:c++17 //upb/... //upb_generator/... //python/... //protos/... //protos_generator/...
+          version: 6.3.0
           exclude-targets: -//python:conformance_test -//upb/reflection:def_builder_test
 
   macos:
@@ -107,6 +109,7 @@ jobs:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-macos"
           bazel: ${{ matrix.config.bazel-command }} --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 ${{ matrix.config.flags }} //bazel/... //benchmarks/... //lua/... //protos/... //protos_generator/... //python/... //upb/... //upb_generator/...
+          version: 6.3.0
 
   no-python:
     strategy:
diff --git a/ci/common.bazelrc b/ci/common.bazelrc
index 12445ba717..fd24b0a3c1 100644
--- a/ci/common.bazelrc
+++ b/ci/common.bazelrc
@@ -35,7 +35,6 @@ build:ubsan --copt=-fno-sanitize=function --copt=-fno-sanitize=vptr
 build --incompatible_check_sharding_support
 build --incompatible_default_to_explicit_init_py
 build --incompatible_disable_native_android_rules
-build --incompatible_disable_runtimes_filegroups
 build --incompatible_disable_target_provider_fields
 build --incompatible_disallow_empty_glob
 build --incompatible_dont_use_javasourceinfoprovider
@@ -66,3 +65,7 @@ build --incompatible_use_host_features
 #   --incompatible_disable_objc_library_transition
 #   --incompatible_fail_on_unknown_attributes
 #   --incompatible_merge_fixed_and_default_shell_env
+
+# TODO: migrate all dependencies from WORKSPACE to MODULE.bazel
+# https://github.com/protocolbuffers/protobuf/issues/14313
+common --noenable_bzlmod
\ No newline at end of file