diff --git a/plugins/protocolbuffers/cpp/v28.3/Dockerfile b/plugins/protocolbuffers/cpp/v28.3/Dockerfile
index c246a276..0a1e3777 100644
--- a/plugins/protocolbuffers/cpp/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/cpp/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD cpp.cc plugins/
-RUN bazel build '//plugins:protoc-gen-cpp.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-cpp.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base
 
diff --git a/plugins/protocolbuffers/csharp/v28.3/Dockerfile b/plugins/protocolbuffers/csharp/v28.3/Dockerfile
index 15d95adf..a83b6a01 100644
--- a/plugins/protocolbuffers/csharp/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/csharp/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD csharp.cc plugins/
-RUN bazel build '//plugins:protoc-gen-csharp.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-csharp.stripped'
 
 FROM mcr.microsoft.com/dotnet/sdk:8.0.403-bookworm-slim@sha256:cab0284cce7bc26d41055d0ac5859a69a8b75d9a201cd226999f4f00cc983f13 AS dotnetrestore
 WORKDIR /build
diff --git a/plugins/protocolbuffers/java/v28.3/Dockerfile b/plugins/protocolbuffers/java/v28.3/Dockerfile
index 1a5b359c..54d7c5a1 100644
--- a/plugins/protocolbuffers/java/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/java/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD java.cc plugins/
-RUN bazel build '//plugins:protoc-gen-java.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-java.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base
 
diff --git a/plugins/protocolbuffers/kotlin/v28.3/Dockerfile b/plugins/protocolbuffers/kotlin/v28.3/Dockerfile
index 828f1c35..6c812840 100644
--- a/plugins/protocolbuffers/kotlin/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/kotlin/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD kotlin.cc plugins/
-RUN bazel build '//plugins:protoc-gen-kotlin.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-kotlin.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base
 
diff --git a/plugins/protocolbuffers/objc/v28.3/Dockerfile b/plugins/protocolbuffers/objc/v28.3/Dockerfile
index af506bf0..611129f7 100644
--- a/plugins/protocolbuffers/objc/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/objc/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD objectivec.cc plugins/
-RUN bazel build '//plugins:protoc-gen-objectivec.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-objectivec.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base
 
diff --git a/plugins/protocolbuffers/php/v28.3/Dockerfile b/plugins/protocolbuffers/php/v28.3/Dockerfile
index 2516c182..7d192d94 100644
--- a/plugins/protocolbuffers/php/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/php/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD php.cc plugins/
-RUN bazel build '//plugins:protoc-gen-php.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-php.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base
 
diff --git a/plugins/protocolbuffers/pyi/v28.3/Dockerfile b/plugins/protocolbuffers/pyi/v28.3/Dockerfile
index f4290273..41ccff30 100644
--- a/plugins/protocolbuffers/pyi/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/pyi/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY BUILD pyi.cc plugins/
-RUN bazel build '//plugins:protoc-gen-pyi.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-pyi.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base
 
diff --git a/plugins/protocolbuffers/python/v28.3/Dockerfile b/plugins/protocolbuffers/python/v28.3/Dockerfile
index dfea420e..bbc85dbd 100644
--- a/plugins/protocolbuffers/python/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/python/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD python.cc plugins/
-RUN bazel build '//plugins:protoc-gen-python.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-python.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base
 
diff --git a/plugins/protocolbuffers/ruby/v28.3/Dockerfile b/plugins/protocolbuffers/ruby/v28.3/Dockerfile
index a3cb6f9f..29f5fffb 100644
--- a/plugins/protocolbuffers/ruby/v28.3/Dockerfile
+++ b/plugins/protocolbuffers/ruby/v28.3/Dockerfile
@@ -2,21 +2,24 @@
 FROM debian:bookworm-20241016 AS build
 
 ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
 
 RUN apt-get update \
- && apt-get install -y curl git cmake build-essential g++ unzip zip
-RUN arch=${TARGETARCH}; \
-    if [ "${arch}" = "amd64" ]; then arch="x86_64"; fi; \
-    curl -fsSL -o /usr/local/bin/bazel https://github.com/bazelbuild/bazel/releases/download/7.4.0/bazel-7.4.0-linux-${arch} \
- && chmod +x /usr/local/bin/bazel
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.23.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
 
+USER nobody
 WORKDIR /build
 RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz \
  && tar --strip-components=1 -zxf protoc.tar.gz \
  && rm protoc.tar.gz
-RUN bazel build '//:protoc_lib'
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
 COPY --link BUILD ruby.cc plugins/
-RUN bazel build '//plugins:protoc-gen-ruby.stripped'
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-ruby.stripped'
 
 FROM gcr.io/distroless/cc-debian12:latest@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8 AS base