diff --git a/.bazelrc b/.bazelrc
index 24aeea4..6919026 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,4 +1,3 @@
-common --enable_bzlmod
 common --test_tag_filters=-manual
 
 try-import %workspace%/ci.bazelrc
diff --git a/.bazelversion b/.bazelversion
index 91e4a9f..deeb3d6 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-6.3.2
+9.2.0
diff --git a/.bcr/presubmit.yml b/.bcr/presubmit.yml
index 984e462..1739792 100644
--- a/.bcr/presubmit.yml
+++ b/.bcr/presubmit.yml
@@ -1,13 +1,11 @@
 matrix:
   platform: ["macos", "ubuntu2004"]
-  bazel: ["7.x", "rolling"]
+  bazel: ["8.x", "9.x", "rolling"]
 
 tasks:
   verify_targets:
     name: "Verify build targets"
     platform: ${{ platform }}
     bazel: ${{ bazel }}
-    build_flags:
-      - "--enable_bzlmod=true"
     build_targets:
       - "@rules_pmd//pmd/..."
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
index 534a6c0..e1fa37f 100644
--- a/.github/workflows/ci.bazelrc
+++ b/.github/workflows/ci.bazelrc
@@ -1,7 +1,6 @@
 # This file contains Bazel settings to apply on CI only.
 # It is referenced with a --bazelrc option in the call to bazel in ci.yaml
 common --curses=no
-common --enable_bzlmod
 
 build --verbose_failures
 build --worker_verbose
@@ -12,7 +11,8 @@ build --announce_rc
 # We do not enable the repository cache to cache downloaded external artifacts
 # as these are generally faster to download again than to fetch them from the
 # GitHub actions cache.
-build --disk_cache=~/.cache/bazel
+build --disk_cache=~/.cache/bazel-disk-cache
+
 # Don't rely on test logs being easily accessible from the test runner,
 # though it makes the log noisier.
 test --test_output=errors
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f0bba40..227619e 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,7 +1,16 @@
 name: CI
 
 on:
+  push:
+    branches: [master]
   pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  # Cancel previous actions from the same PR or branch except 'master' branch.
+  group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'master' && format('::{0}', github.run_id) || ''}}
+  cancel-in-progress: ${{ github.ref_name != 'master' }}
 
 jobs:
   buildifier:
@@ -9,49 +18,51 @@ jobs:
     steps:
       - name: "Checkout the sources"
         uses: actions/checkout@v7.0.1
-      - name: "Install JDK 11"
+      - name: "Install JDK 21"
         uses: actions/setup-java@v5
         with:
           distribution: "zulu"
-          java-version: "11"
+          java-version: "21"
       - name: "Setup Bazelisk"
         uses: bazelbuild/setup-bazelisk@v3
       - name: "Linting Starlark"
         run: bazel run @buildifier_prebuilt//:buildifier -- -mode check -lint warn -r .
 
-  build-bzlmod:
-    runs-on: ubuntu-22.04
+  build:
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        bazel_version: ["8.x", "9.x"]
+    runs-on: ${{ matrix.os }}
+    name: build (${{ matrix.os }}, bazel ${{ matrix.bazel_version }})
     steps:
       - name: "Checkout the sources"
         uses: actions/checkout@v7.0.1
-      - name: "Install JDK 11"
+      - name: "Install JDK 21"
         uses: actions/setup-java@v5
         with:
           distribution: "zulu"
-          java-version: "11"
+          java-version: "21"
+      - name: Mount bazel caches
+        uses: actions/cache@v5.0.3
+        with:
+          path: |
+            ~/.cache/bazel-disk-cache
+          key: bazel-cache-${{ matrix.os }}-${{ matrix.bazel_version }}-${{ hashFiles('**/BUILD.bazel', '**/*.bzl', 'MODULE.bazel') }}
+          restore-keys: bazel-cache-${{ matrix.os }}-${{ matrix.bazel_version }}-
       - name: "Setup Bazelisk"
         uses: bazelbuild/setup-bazelisk@v3
       - name: "Configure Bazel"
         run: cp .github/workflows/ci.bazelrc .
       - name: "Build"
-        run: bazel build //... --enable_bzlmod=True
+        env:
+          USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
+        run: bazel build //...
       - name: "Unit tests"
-        run: bazel test //... --enable_bzlmod=True
+        env:
+          USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
+        run: bazel test //...
       - name: "Integration tests"
+        env:
+          USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
         run: bash tests/integration/suite.sh
-  build-workspace:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: "Checkout the sources"
-        uses: actions/checkout@v7.0.1
-      - name: "Install JDK 11"
-        uses: actions/setup-java@v5
-        with:
-          distribution: "zulu"
-          java-version: "11"
-      - name: "Setup Bazelisk"
-        uses: bazelbuild/setup-bazelisk@v3
-      - name: "Configure Bazel"
-        run: cp .github/workflows/ci.bazelrc .
-      - name: "Build"
-        run: bazel build //... --enable_bzlmod=False
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
index 83683af..984fb5a 100755
--- a/.github/workflows/release_prep.sh
+++ b/.github/workflows/release_prep.sh
@@ -23,19 +23,4 @@ cat << EOF
 \`\`\`starlark
 bazel_dep(name = "rules_pmd", version = "${TAG:1}")
 \`\`\`
-
-## Using WORKSPACE
-
-Paste this snippet into your `WORKSPACE.bazel` file:
-
-\`\`\`starlark
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-http_archive(
-    name = "rules_pmd",
-    sha256 = "${SHA}",
-    strip_prefix = "${PREFIX}",
-    url = "https://github.com/buildfoundation/bazel_rules_pmd/releases/download/${TAG}/${ARCHIVE}",
-)
 EOF
-
-echo "\`\`\`"
diff --git a/MODULE.bazel b/MODULE.bazel
index 3ab2292..9adc724 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -8,7 +8,8 @@ module(
 pmd = use_extension("//pmd:extensions.bzl", "pmd")
 use_repo(pmd, "net_sourceforge_pmd")
 
-bazel_dep(name = "rules_java", version = "5.5.0")
-bazel_dep(name = "bazel_skylib", version = "1.4.1", dev_dependency = True)
-bazel_dep(name = "stardoc", version = "0.5.3", repo_name = "io_bazel_stardoc", dev_dependency = True)
-bazel_dep(name = "buildifier_prebuilt", version = "6.3.3", dev_dependency = True)
+bazel_dep(name = "rules_java", version = "9.3.0")
+
+bazel_dep(name = "bazel_skylib", version = "1.9.2", dev_dependency = True)
+bazel_dep(name = "stardoc", version = "0.8.1", dev_dependency = True, repo_name = "io_bazel_stardoc")
+bazel_dep(name = "buildifier_prebuilt", version = "8.5.1.3", dev_dependency = True)
diff --git a/README.md b/README.md
index 0739420..a06d660 100644
--- a/README.md
+++ b/README.md
@@ -11,34 +11,11 @@ for [the Bazel build system](https://bazel.build).
 bazel_dep(name = "rules_pmd", version = "...")
 ```
 
-### `WORKSPACE` Configuration
-
-Declare the rule in the `WORKSPACE` file.
-Please refer to [GitHub releases](https://github.com/buildfoundation/bazel_rules_pmd/releases) for the version and the SHA-256 hashsum.
-
-```starlark
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-rules_pmd_version = "REPLACE_ME"
-rules_pmd_sha = "REPLACE_ME"
-
-http_archive(
-    name = "rules_pmd",
-    sha256 = rules_pmd_sha,
-    strip_prefix = "bazel_rules_pmd-{v}".format(v = rules_pmd_version),
-    url = "https://github.com/buildfoundation/bazel_rules_pmd/archive/v{v}.tar.gz".format(v = rules_pmd_version),
-)
-
-load("@rules_pmd//pmd:dependencies.bzl", "rules_pmd_dependencies")
-rules_pmd_dependencies()
-
-load("@rules_pmd//pmd:toolchains.bzl", "rules_pmd_toolchains")
-rules_pmd_toolchains()
-```
+Please refer to [GitHub releases](https://github.com/buildfoundation/bazel_rules_pmd/releases) for the available versions.
 
 ### `BUILD` Configuration
 
-Once declared in the `WORSKPACE` file, the rule can be loaded in the `BUILD` file.
+Once declared in the `MODULE.bazel` file, the rule can be loaded in the `BUILD` file.
 
 ```starlark
 load("@rules_pmd//pmd:defs.bzl", "pmd_test")
@@ -62,20 +39,6 @@ pmd.pmd_version(
 use_repo(pmd, "net_sourceforge_pmd")
 ```
 
-Or change the `WORKSPACE` file:
-
-```python
-load("@rules_pmd//pmd:versions.bzl", "pmd_version")
-load("@rules_pmd//pmd:dependencies.bzl", "rules_pmd_dependencies")
-
-rules_pmd_dependencies(
-    pmd_version = pmd_version(
-        version = "x.x.x",
-        sha256 = "x.x.x.sha256",
-    )
-)
-```
-
 See [available attributes](docs/rule.md).
 
 ### Execution
diff --git a/WORKSPACE b/WORKSPACE
deleted file mode 100644
index 411fd85..0000000
--- a/WORKSPACE
+++ /dev/null
@@ -1,73 +0,0 @@
-workspace(name = "rules_pmd")
-
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-# Runtime
-
-## Dependencies
-
-load("//pmd:dependencies.bzl", "rules_pmd_dependencies")
-
-rules_pmd_dependencies()
-
-## Toolchains
-
-load("//pmd:toolchains.bzl", "rules_pmd_toolchains")
-
-rules_pmd_toolchains()
-
-# Testing
-
-## Skylib
-
-skylib_version = "1.4.1"
-
-skylib_sha = "b8a1527901774180afc798aeb28c4634bdccf19c4d98e7bdd1ce79d1fe9aaad7"
-
-http_archive(
-    name = "bazel_skylib",
-    sha256 = skylib_sha,
-    url = "https://github.com/bazelbuild/bazel-skylib/releases/download/{v}/bazel-skylib-{v}.tar.gz".format(v = skylib_version),
-)
-
-load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
-
-bazel_skylib_workspace()
-
-# Documenting
-
-## Stardoc
-
-stardoc_version = "0.5.3"
-
-stardoc_sha = "fc95cd29422f1d67395352804d03252aa77714e88dcbefd4d3b070d70ed75de7"
-
-http_archive(
-    name = "io_bazel_stardoc",
-    sha256 = stardoc_sha,
-    strip_prefix = "stardoc-{v}".format(v = stardoc_version),
-    url = "https://github.com/bazelbuild/stardoc/archive/{v}.tar.gz".format(v = stardoc_version),
-)
-
-load("@io_bazel_stardoc//:setup.bzl", "stardoc_repositories")
-
-stardoc_repositories()
-
-# Linting
-
-## Buildifier
-
-http_archive(
-    name = "buildifier_prebuilt",
-    sha256 = "b3fd85ae7e45c2f36bce52cfdbdb6c20261761ea5928d1686edc8873b0d0dad0",
-    strip_prefix = "buildifier-prebuilt-5.1.0",
-    url = "http://github.com/keith/buildifier-prebuilt/archive/5.1.0.tar.gz",
-)
-
-load("@buildifier_prebuilt//:deps.bzl", "buildifier_prebuilt_deps")
-
-buildifier_prebuilt_deps()
-
-load("@buildifier_prebuilt//:defs.bzl", "buildifier_prebuilt_register_toolchains")
-
-buildifier_prebuilt_register_toolchains()
diff --git a/WORKSPACE.bzlmod b/WORKSPACE.bzlmod
deleted file mode 100644
index e69de29..0000000
diff --git a/pmd/defs.bzl b/pmd/defs.bzl
index 1507e85..fd1715e 100644
--- a/pmd/defs.bzl
+++ b/pmd/defs.bzl
@@ -78,7 +78,7 @@ def _impl(ctx):
         DefaultInfo(
             files = depset(outputs),
             executable = execution_result,
-        )
+        ),
     ]
 
 def _write_files_list(ctx, files, file_name):
@@ -105,7 +105,7 @@ pmd_test = rule(
         "_executable": attr.label(
             default = "//pmd/wrapper:bin",
             executable = True,
-            cfg = "host",
+            cfg = "exec",
         ),
         "srcs": attr.label_list(
             allow_files = True,
diff --git a/pmd/dependencies.bzl b/pmd/dependencies.bzl
deleted file mode 100644
index dd86242..0000000
--- a/pmd/dependencies.bzl
+++ /dev/null
@@ -1,47 +0,0 @@
-"""
-Macros for defining dependencies.
-See https://docs.bazel.build/versions/master/skylark/deploying.html#dependencies
-"""
-
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
-load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
-load(":versions.bzl", _DEFAULT_PMD_VERSION = "DEFAULT_PMD_RELEASE")
-
-_PMD_BUILD_FILE_TEMPLATE = Label("//pmd:BUILD.pmd.bazel")
-
-def rules_pmd_dependencies(pmd_release = _DEFAULT_PMD_VERSION):
-    """Fetches `rules_pmd` dependencies.
-
-    Declares dependencies of the `rules_pmd` workspace.
-    Users should call this macro in their `WORKSPACE` file.
-
-    Args:
-        pmd_release: The `pmd_release` target to fetch download.
-    """
-
-    # Java
-
-    rules_java_version = "5.4.1"
-    rules_java_sha = "a1f82b730b9c6395d3653032bd7e3a660f9d5ddb1099f427c1e1fe768f92e395"
-
-    maybe(
-        repo_rule = http_archive,
-        name = "rules_java",
-        url = "https://github.com/bazelbuild/rules_java/releases/download/{v}/rules_java-{v}.tar.gz".format(v = rules_java_version),
-        sha256 = rules_java_sha,
-    )
-
-    _rules_pmd_bzlmod_dependencies(pmd_release = pmd_release)
-
-def _rules_pmd_bzlmod_dependencies(pmd_release):
-    if not pmd_release:
-        fail("Error: Please provide `pmd_release` when calling rules_pmd_dependencies")
-
-    maybe(
-        repo_rule = http_archive,
-        name = "net_sourceforge_pmd",
-        url = "https://github.com/pmd/pmd/releases/download/pmd_releases/{v}/pmd-bin-{v}.zip".format(v = pmd_release.version),
-        strip_prefix = "pmd-bin-{v}/lib".format(v = pmd_release.version),
-        sha256 = pmd_release.sha256,
-        build_file = _PMD_BUILD_FILE_TEMPLATE,
-    )
diff --git a/pmd/extensions.bzl b/pmd/extensions.bzl
index 11bfb0b..f596e25 100644
--- a/pmd/extensions.bzl
+++ b/pmd/extensions.bzl
@@ -1,3 +1,5 @@
+"""Module extension for fetching the PMD distribution."""
+
 load(
     "@bazel_tools//tools/build_defs/repo:http.bzl",
     "http_archive",
diff --git a/pmd/toolchains.bzl b/pmd/toolchains.bzl
deleted file mode 100644
index 5afb8c1..0000000
--- a/pmd/toolchains.bzl
+++ /dev/null
@@ -1,16 +0,0 @@
-"""
-Macros for defining toolchains.
-See https://docs.bazel.build/versions/master/skylark/deploying.html#registering-toolchains
-"""
-
-load("@rules_java//java:repositories.bzl", "rules_java_dependencies", "rules_java_toolchains")
-
-def rules_pmd_toolchains():
-    """Invokes `rules_pmd` toolchains.
-
-    Declares toolchains that are dependencies of the `rules_pmd` workspace.
-    Users should call this macro in their `WORKSPACE` file.
-    """
-
-    rules_java_dependencies()
-    rules_java_toolchains()
diff --git a/pmd/versions.bzl b/pmd/versions.bzl
index a6d4f32..dcb9360 100644
--- a/pmd/versions.bzl
+++ b/pmd/versions.bzl
@@ -1,3 +1,5 @@
+"""PMD release definitions."""
+
 def pmd_version(version, sha256):
     """Create a pmd version.
 
diff --git a/tests/analysis/tests.bzl b/tests/analysis/tests.bzl
index 7a46747..b0d1937 100644
--- a/tests/analysis/tests.bzl
+++ b/tests/analysis/tests.bzl
@@ -41,6 +41,15 @@ def _expand_paths(ctx, values):
         for value in values
     ]
 
+def _asserted_input_short_paths(action):
+    # ponytail: the wrapper runfiles tree is named `_middlemen/…` on Bazel 8 and
+    # `…/bin.runfiles` on Bazel 9, so it is skipped instead of asserted.
+    return sorted([
+        file.short_path
+        for file in action.inputs.to_list()
+        if not file.short_path.startswith("_middlemen/") and not file.short_path.endswith(".runfiles")
+    ])
+
 # Action full contents test
 
 def _action_full_contents_test_impl(ctx):
@@ -110,9 +119,8 @@ def _action_full_contents_test_impl(ctx):
         "{{source_dir}}/path D.kt",
         "{{source_dir}}/path E.kt",
         "{{source_dir}}/rulesets.xml",
-        "_middlemen/pmd_Swrapper_Sbin-runfiles",
-        "pmd/wrapper/bin.jar",
         "pmd/wrapper/bin",
+        "pmd/wrapper/bin.jar",
     ])
 
     expected_outputs = _expand_paths(env.ctx, [
@@ -120,8 +128,8 @@ def _action_full_contents_test_impl(ctx):
         "{{source_dir}}/test_target_full_execution_result.sh",
     ])
 
-    asserts.equals(env, expected_inputs, [file.short_path for file in action.inputs.to_list()])
-    asserts.equals(env, expected_outputs, [file.short_path for file in action.outputs.to_list()])
+    asserts.equals(env, sorted(expected_inputs), _asserted_input_short_paths(action))
+    asserts.equals(env, sorted(expected_outputs), sorted([file.short_path for file in action.outputs.to_list()]))
 
     return analysistest.end(env)
 
@@ -199,9 +207,8 @@ def _action_blank_contents_test_impl(ctx):
         "{{source_dir}}/path B.kt",
         "{{source_dir}}/path C.kt",
         "{{source_dir}}/rulesets.xml",
-        "_middlemen/pmd_Swrapper_Sbin-runfiles",
-        "pmd/wrapper/bin.jar",
         "pmd/wrapper/bin",
+        "pmd/wrapper/bin.jar",
     ])
 
     expected_outputs = _expand_paths(env.ctx, [
@@ -209,8 +216,8 @@ def _action_blank_contents_test_impl(ctx):
         "{{source_dir}}/test_target_blank_execution_result.sh",
     ])
 
-    asserts.equals(env, expected_inputs, [file.short_path for file in action.inputs.to_list()])
-    asserts.equals(env, expected_outputs, [file.short_path for file in action.outputs.to_list()])
+    asserts.equals(env, sorted(expected_inputs), _asserted_input_short_paths(action))
+    asserts.equals(env, sorted(expected_outputs), sorted([file.short_path for file in action.outputs.to_list()]))
 
     return analysistest.end(env)
 
diff --git a/tests/integration/test_error.sh b/tests/integration/test_error.sh
index 5512e9b..9fd5143 100755
--- a/tests/integration/test_error.sh
+++ b/tests/integration/test_error.sh
@@ -9,7 +9,7 @@ echo ":: Target with error rulesets produces error."
 echo
 
 set +e
-bazel test //tests/integration:${TARGET} > /dev/null
+bazel test ${EXTRA_BAZEL_ARGS:-} //tests/integration:${TARGET}
 
 readonly BAZEL_EXIT_CODE=$?
 set -e
diff --git a/tests/integration/test_errorless.sh b/tests/integration/test_errorless.sh
index 4aa0a4a..4f76cf0 100755
--- a/tests/integration/test_errorless.sh
+++ b/tests/integration/test_errorless.sh
@@ -9,7 +9,7 @@ echo ":: Target with errorless rulesets does not produce error."
 echo
 
 set +e
-bazel test //tests/integration:${TARGET} > /dev/null
+bazel test ${EXTRA_BAZEL_ARGS:-} //tests/integration:${TARGET}
 
 readonly BAZEL_EXIT_CODE=$?
 set -e