diff --git a/.bazelrc b/.bazelrc
index 8d1afdf..566520a 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -9,3 +9,11 @@ common:ci --nobuild_runfile_links
 # Override the preset's `--lockfile_mode=error` on CI since we don't
 # yet commit MODULE.bazel.lock — see .gitignore.
 common:ci --lockfile_mode=off
+
+# Bazel doesn't create runfiles trees on Windows by default, breaking tests
+# that resolve data files by relative path (e.g. bazel-lib's assert_contains).
+# The preset enables --enable_platform_specific_config, so config=windows is
+# applied automatically on Windows hosts. --windows_enable_symlinks is a no-op
+# elsewhere.
+startup --windows_enable_symlinks
+common:windows --enable_runfiles
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
index f50170e..3b559c3 100755
--- a/.github/workflows/release_prep.sh
+++ b/.github/workflows/release_prep.sh
@@ -8,18 +8,19 @@ TAG=$1
 # The prefix is chosen to match what GitHub generates for source archives
 PREFIX="rules_terser-${TAG:1}"
 ARCHIVE="rules_terser-$TAG.tar.gz"
-git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
+git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip >$ARCHIVE
 SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
 
 # Add generated API docs to the release, see https://github.com/bazelbuild/bazel-central-registry/issues/5593
-docs="$(mktemp -d)"; targets="$(mktemp)"
+docs="$(mktemp -d)"
+targets="$(mktemp)"
 bazel --output_base="$docs" query --output=label --output_file="$targets" 'kind("starlark_doc_extract rule", //...)'
 bazel --output_base="$docs" build --target_pattern_file="$targets" --remote_download_regex='.*doc_extract\.binaryproto'
 tar --create --auto-compress \
-    --directory "$(bazel --output_base="$docs" info bazel-bin)" \
-    --file "$GITHUB_WORKSPACE/${ARCHIVE%.tar.gz}.docs.tar.gz" .
+	--directory "$(bazel --output_base="$docs" info bazel-bin)" \
+	--file "$GITHUB_WORKSPACE/${ARCHIVE%.tar.gz}.docs.tar.gz" .
 
-cat << EOF
+cat <<EOF
 WORKSPACE snippet:
 \`\`\`starlark
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
@@ -33,4 +34,4 @@ EOF
 
 awk 'f;/--SNIP--/{f=1}' e2e/smoke/WORKSPACE.bazel
 
-echo "\`\`\`"
\ No newline at end of file
+echo "\`\`\`"
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 36dd854..5cf55b7 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -3,7 +3,6 @@
 # This is easier than having to run manual `git` operations on a local clone.
 # It also runs on a schedule so we don't leave commits unreleased indefinitely
 # (avoiding users having to ping "hey could someone cut a release").
-
 name: Tag a Release
 on:
   # Allow devs to tag manually through the GitHub UI.
@@ -14,7 +13,7 @@ on:
   # which overwhelms BCR maintainers and over-notifies users,
   # and releasing too infrequently which delays delivery of bugfixes and features.
   schedule:
-    - cron: "0 15 9,23 * *"
+    - cron: '0 15 9,23 * *'
 jobs:
   tag:
     permissions:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index cb16842..e9384f6 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,11 +1,9 @@
 # See CONTRIBUTING.md for instructions.
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
-
 # Commitizen runs in commit-msg stage
 # but we don't want to run the other hooks on commit messages
 default_stages: [commit]
-
 repos:
   # Check formatting and lint for starlark code
   - repo: https://github.com/keith/pre-commit-buildifier
diff --git a/BUILD.bazel b/BUILD.bazel
index 32f614c..6251986 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -17,4 +17,5 @@ alias(
 alias(
     name = "gazelle",
     actual = "//tools/gazelle",
+    tags = ["manual"],  # tag as manual so windows ci does not build it by default
 )
diff --git a/MODULE.bazel b/MODULE.bazel
index be5eae5..93a6f4a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -16,10 +16,10 @@ use_repo(tel, "aspect_tools_telemetry_report")
 
 ####### Dev dependencies ########
 
-bazel_dep(name = "aspect_gazelle_prebuilt", version = "0.0.11", dev_dependency = True)
-bazel_dep(name = "aspect_rules_lint", version = "1.0.0-rc9", dev_dependency = True)
-bazel_dep(name = "bazelrc-preset.bzl", version = "1.1.0", dev_dependency = True)
-bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
+bazel_dep(name = "aspect_gazelle_prebuilt", version = "0.0.20", dev_dependency = True)
+bazel_dep(name = "aspect_rules_lint", version = "2.6.0", dev_dependency = True)
+bazel_dep(name = "bazelrc-preset.bzl", version = "1.9.2", dev_dependency = True)
+bazel_dep(name = "buildifier_prebuilt", version = "8.5.1.2", dev_dependency = True)
 
 npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm", dev_dependency = True)
 npm.npm_translate_lock(
diff --git a/tools/preset.bazelrc b/tools/preset.bazelrc
index e5950a2..a890e27 100644
--- a/tools/preset.bazelrc
+++ b/tools/preset.bazelrc
@@ -67,6 +67,11 @@ common --experimental_fetch_all_coverage_outputs
 common --experimental_remote_cache_eviction_retries=5
 # Docs: https://registry.build/flag/bazel@7.6.0?filter=experimental_remote_cache_eviction_retries
 
+# Discard Merkle trees for remote actions reducing memory usage significantly.
+# Requires Bazel to recompute them upon remote cache misses and retries.
+common --experimental_remote_discard_merkle_trees
+# Docs: https://registry.build/flag/bazel@7.6.0?filter=experimental_remote_discard_merkle_trees
+
 # This flag was added in Bazel 5.0.0 with a default of zero:
 # https://github.com/bazelbuild/bazel/commit/a1137ec1338d9549fd34a9a74502ffa58c286a8e
 # For Bazel 8.0.0 the default was changed to 5:
@@ -122,6 +127,10 @@ common --incompatible_default_to_explicit_init_py
 common --incompatible_disallow_empty_glob
 # Docs: https://registry.build/flag/bazel@7.6.0?filter=incompatible_disallow_empty_glob
 
+# Accept multiple --modify_execution_info flags, rather than the last flag overwriting earlier ones.
+common --incompatible_modify_execution_info_additive
+# Docs: https://registry.build/flag/bazel@7.6.0?filter=incompatible_modify_execution_info_additive
+
 # Make builds more reproducible by using a static value for PATH and not inheriting LD_LIBRARY_PATH.
 # Use `--action_env=ENV_VARIABLE` if you want to inherit specific variables from the environment where Bazel runs.
 # Note that doing so can prevent cross-user caching if a shared cache is used.
@@ -135,6 +144,11 @@ common --incompatible_strict_action_env
 common --nolegacy_external_runfiles
 # Docs: https://registry.build/flag/bazel@7.6.0?filter=legacy_external_runfiles
 
+# Fail the build if the MODULE.bazel.lock file is out of date.
+# Using this mode in ci prevents the lockfile from being out of date.
+common:ci --lockfile_mode="error"
+# Docs: https://registry.build/flag/bazel@7.6.0?filter=lockfile_mode
+
 # On CI, don't download remote outputs to the local machine.
 # Most CI pipelines don't need to access the files and they can remain at rest on the remote cache.
 # Significant time can be spent on needless downloads, which is especially noticeable on fully-cached builds.