diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 5e83f46..661c84d 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -16,19 +16,32 @@ tasks:
     platform: ubuntu1804
     bazel: latest
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
     test_flags:
     - "--test_env=PATH"
 
   ubuntu1604_latest:
-    <<: *reusable_config
     name: "Latest Bazel"
     platform: ubuntu1604
     bazel: latest
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
+    build_targets:
+    - "--"
+    - "//..."
+    - "@bazel_skylib_gazelle_plugin//..."
+    # //distribution requires Python >= 3.6 for some rules_pkg scripts; Ubuntu 16.04 has Python 3.5
+    - "-//distribution/..."
     test_flags:
     - "--test_env=PATH"
+    test_targets:
+    - "--"
+    - "//..."
+    - "@bazel_skylib_gazelle_plugin//..."
+    # //distribution requires Python >= 3.6 for some rules_pkg scripts; Ubuntu 16.04 has Python 3.5
+    - "-//distribution/..."
 
   macos_latest:
     <<: *reusable_config
@@ -36,6 +49,7 @@ tasks:
     platform: macos
     bazel: latest
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
     test_flags:
     - "--test_env=PATH"
@@ -46,6 +60,7 @@ tasks:
     platform: windows
     bazel: latest
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
     test_flags:
     # TODO(laszlocsomor): remove "--test_env=LOCALAPPDATA" after
@@ -59,19 +74,32 @@ tasks:
     platform: ubuntu1804
     bazel: last_green
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
     test_flags:
     - "--test_env=PATH"
 
   ubuntu1604_last_green:
-    <<: *reusable_config
     name: "Last Green Bazel"
     platform: ubuntu1604
     bazel: last_green
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
+    build_targets:
+    - "--"
+    - "//..."
+    - "@bazel_skylib_gazelle_plugin//..."
+    # //distribution requires Python >= 3.6 for some rules_pkg scripts; Ubuntu 16.04 has Python 3.5
+    - "-//distribution/..."
     test_flags:
     - "--test_env=PATH"
+    test_targets:
+    - "--"
+    - "//..."
+    - "@bazel_skylib_gazelle_plugin//..."
+    # //distribution requires Python >= 3.6 for some rules_pkg scripts; Ubuntu 16.04 has Python 3.5
+    - "-//distribution/..."
 
   macos_last_green:
     <<: *reusable_config
@@ -79,6 +107,7 @@ tasks:
     platform: macos
     bazel: last_green
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
     test_flags:
     - "--test_env=PATH"
@@ -89,6 +118,7 @@ tasks:
     platform: windows
     bazel: last_green
     build_flags:
+    - "--incompatible_config_setting_private_default_visibility"
     - "--incompatible_disallow_empty_glob"
     test_flags:
     # TODO(laszlocsomor): remove "--test_env=LOCALAPPDATA" after
@@ -102,10 +132,11 @@ tasks:
     platform: ubuntu1804
     bazel: last_green
     build_flags:
-      - "--incompatible_disallow_empty_glob"
-      - "--experimental_enable_bzlmod"
+    - "--enable_bzlmod"
+    - "--incompatible_config_setting_private_default_visibility"
+    - "--incompatible_disallow_empty_glob"
     test_flags:
-      - "--experimental_enable_bzlmod"
-      - "--test_env=PATH"
+    - "--enable_bzlmod"
+    - "--test_env=PATH"
 
 buildifier: latest
diff --git a/MODULE.bazel b/MODULE.bazel
index ed3befe..0cdaad3 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -16,7 +16,7 @@ bazel_dep(name = "platforms", version = "0.0.4")
 
 # Build-only / test-only dependencies
 bazel_dep(name = "stardoc", version = "0.5.6", dev_dependency = True, repo_name = "io_bazel_stardoc")
-bazel_dep(name = "rules_pkg", version = "0.7.0", dev_dependency = True)
+bazel_dep(name = "rules_pkg", version = "0.9.1", dev_dependency = True)
 bazel_dep(name = "rules_cc", version = "0.0.2", dev_dependency = True)
 
 # Needed for bazelci and for building distribution tarballs.
diff --git a/WORKSPACE b/WORKSPACE
index 4f5fa72..de97069 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -41,10 +41,10 @@ stardoc_repositories()
 maybe(
     http_archive,
     name = "rules_pkg",
-    sha256 = "8a298e832762eda1830597d64fe7db58178aa84cd5926d76d5b744d6558941c2",
+    sha256 = "8f9ee2dc10c1ae514ee599a8b42ed99fa262b757058f65ad3c384289ff70c4b8",
     urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_pkg/releases/download/0.7.0/rules_pkg-0.7.0.tar.gz",
-        "https://github.com/bazelbuild/rules_pkg/releases/download/0.7.0/rules_pkg-0.7.0.tar.gz",
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_pkg/releases/download/0.9.1/rules_pkg-0.9.1.tar.gz",
+        "https://github.com/bazelbuild/rules_pkg/releases/download/0.9.1/rules_pkg-0.9.1.tar.gz",
     ],
 )