diff --git a/.aspect/bazelrc/BUILD.bazel b/.aspect/bazelrc/BUILD.bazel
deleted file mode 100644
index bfa2fb35..00000000
--- a/.aspect/bazelrc/BUILD.bazel
+++ /dev/null
@@ -1,5 +0,0 @@
-"Aspect bazelrc presets; see https://docs.aspect.build/guides/bazelrc"
-
-load("@aspect_bazel_lib//lib:bazelrc_presets.bzl", "write_aspect_bazelrc_presets")
-
-write_aspect_bazelrc_presets(name = "update_aspect_bazelrc_presets")
diff --git a/.aspect/bazelrc/bazel6.bazelrc b/.aspect/bazelrc/bazel6.bazelrc
deleted file mode 100644
index e92513c4..00000000
--- a/.aspect/bazelrc/bazel6.bazelrc
+++ /dev/null
@@ -1,63 +0,0 @@
-# Not using common here because https://github.com/bazelbuild/bazel/pull/18609 was added in Bazel 6.3.0
-
-# Speed up all builds by not checking if external repository files have been modified.
-# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
-build --noexperimental_check_external_repository_files
-fetch --noexperimental_check_external_repository_files
-query --noexperimental_check_external_repository_files
-
-# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
-# Save time on Sandbox creation and deletion when many of the same kind of action run during the
-# build.
-# Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
-build --reuse_sandbox_directories
-
-# Avoid this flag being enabled by remote_download_minimal or remote_download_toplevel
-# See https://meroton.com/blog/bazel-6-errors-build-without-the-bytes/
-build --noexperimental_action_cache_store_output_metadata
-
-# Speed up all builds by not checking if output files have been modified. Lets you make changes to
-# the output tree without triggering a build for local debugging. For example, you can modify
-# [rules_js](https://github.com/aspect-build/rules_js) 3rd party npm packages in the output tree
-# when local debugging.
-# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/pkgcache/PackageOptions.java#L185
-# NB: This flag is in bazel6.bazelrc as when used in Bazel 7 is has been observed to break
-# "build without the bytes" --remote_download_outputs=toplevel. See https://github.com/bazel-contrib/bazel-lib/pull/711
-# for more info.
-build --noexperimental_check_output_files
-fetch --noexperimental_check_output_files
-query --noexperimental_check_output_files
-
-# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
-# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
-# Bazel doesn't write to the local disk cache as it treats as a remote cache.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
-# NB: This flag is in bazel6.bazelrc because it became a no-op in Bazel 7 and has been removed
-# in Bazel 8.
-build --incompatible_remote_results_ignore_disk
-
-# Propagate tags from a target declaration to the actions' execution requirements.
-# Ensures that tags applied in your BUILD file, like `tags=["no-remote"]`
-# get propagated to actions created by the rule.
-# Without this option, you rely on rules authors to manually check the tags you passed
-# and apply relevant ones to the actions they create.
-# See https://github.com/bazelbuild/bazel/issues/8830 for details.
-# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
-build --experimental_allow_tags_propagation
-fetch --experimental_allow_tags_propagation
-query --experimental_allow_tags_propagation
-
-# Do not build runfiles symlink forests for external repositories under
-# `.runfiles/wsname/external/repo` (in addition to `.runfiles/repo`). This reduces runfiles &
-# sandbox creation times & prevents accidentally depending on this feature which may flip to off by
-# default in the future. Note, some rules may fail under this flag, please file issues with the rule
-# author.
-# Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
-build --nolegacy_external_runfiles
-
-# The maximum number of attempts to retry a download error.
-# Using the default value from Bazel 8.
-# Docs: https://bazel.build/reference/command-line-reference#common_options-flag--experimental_repository_downloader_retries
-build --experimental_repository_downloader_retries=5
-fetch --experimental_repository_downloader_retries=5
-query --experimental_repository_downloader_retries=5
diff --git a/.aspect/bazelrc/bazel7.bazelrc b/.aspect/bazelrc/bazel7.bazelrc
deleted file mode 100644
index b5a67bf1..00000000
--- a/.aspect/bazelrc/bazel7.bazelrc
+++ /dev/null
@@ -1,33 +0,0 @@
-# Speed up all builds by not checking if external repository files have been modified.
-# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
-common --noexperimental_check_external_repository_files
-
-# Don't report when the root module's lower bound for a dependency happens to be less than the resolved version.
-# This is expected and should NOT prompt an engineer to update our lower bound to match.
-# WARNING: For repository 'aspect_bazel_lib', the root module requires module version aspect_bazel_lib@1.30.2,
-# but got aspect_bazel_lib@1.31.2 in the resolved dependency graph.
-common --check_direct_dependencies=off
-
-# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
-# Save time on Sandbox creation and deletion when many of the same kind of action run during the
-# build.
-# Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
-common --reuse_sandbox_directories
-
-# Do not build runfiles symlink forests for external repositories under
-# `.runfiles/wsname/external/repo` (in addition to `.runfiles/repo`). This reduces runfiles &
-# sandbox creation times & prevents accidentally depending on this feature which may flip to off by
-# default in the future. Note, some rules may fail under this flag, please file issues with the rule
-# author.
-# Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
-common --nolegacy_external_runfiles
-
-# The maximum number of attempts to retry if the build encountered a transient remote cache error that would otherwise fail the build.
-# Using the same value here than what is the default in Bazel 8 to help with https://github.com/bazelbuild/bazel/issues/22387
-# Docs: https://bazel.build/reference/command-line-reference#build-flag--experimental_remote_cache_eviction_retries
-common --experimental_remote_cache_eviction_retries=5
-
-# The maximum number of attempts to retry a download error.
-# Using the default value from Bazel 8.
-# Docs: https://bazel.build/reference/command-line-reference#common_options-flag--experimental_repository_downloader_retries
-common --experimental_repository_downloader_retries=5
diff --git a/.aspect/bazelrc/ci.bazelrc b/.aspect/bazelrc/ci.bazelrc
deleted file mode 100644
index dd6457e5..00000000
--- a/.aspect/bazelrc/ci.bazelrc
+++ /dev/null
@@ -1,66 +0,0 @@
-# Set this flag to enable re-tries of failed tests on CI.
-# When any test target fails, try one or more times. This applies regardless of whether the "flaky"
-# tag appears on the target definition.
-# This is a tradeoff: legitimately failing tests will take longer to report,
-# but we can paper over flaky tests that pass most of the time.
-# The alternative is to mark every flaky test with the `flaky = True` attribute, but this requires
-# the buildcop to make frequent code edits.
-# Not recommended for local builds so that the flakiness is observed during development and thus
-# is more likely to get fixed.
-# Note that when passing after the first attempt, Bazel will give a special "FLAKY" status.
-# Docs: https://bazel.build/docs/user-manual#flaky-test-attempts
-test --flaky_test_attempts=2
-
-# Announce all announces command options read from the bazelrc file(s) when starting up at the
-# beginning of each Bazel invocation. This is very useful on CI to be able to inspect what Bazel rc
-# settings are being applied on each run.
-# Docs: https://bazel.build/docs/user-manual#announce-rc
-common --announce_rc
-
-# Add a timestamp to each message generated by Bazel specifying the time at which the message was
-# displayed.
-# Docs: https://bazel.build/docs/user-manual#show-timestamps
-common --show_timestamps
-
-# Only show progress every 60 seconds on CI.
-# We want to find a compromise between printing often enough to show that the build isn't stuck,
-# but not so often that we produce a long log file that requires a lot of scrolling.
-# https://bazel.build/reference/command-line-reference#flag--show_progress_rate_limit
-common --show_progress_rate_limit=60
-
-# Use cursor controls in screen output.
-# Docs: https://bazel.build/docs/user-manual#curses
-common --curses=yes
-
-# Use colors to highlight output on the screen. Set to `no` if your CI does not display colors.
-# Docs: https://bazel.build/docs/user-manual#color
-common --color=yes
-
-# The terminal width in columns. Configure this to override the default value based on what your CI system renders.
-# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/runtime/UiOptions.java#L151
-common --terminal_columns=143
-
-######################################
-# Generic remote cache configuration #
-######################################
-
-# Only download remote outputs of top level targets to the local machine.
-# Docs: https://bazel.build/reference/command-line-reference#flag--remote_download_toplevel
-common --remote_download_toplevel
-
-# The maximum amount of time to wait for remote execution and cache calls.
-# https://bazel.build/reference/command-line-reference#flag--remote_timeout
-common --remote_timeout=3600
-
-# Upload locally executed action results to the remote cache.
-# Docs: https://bazel.build/reference/command-line-reference#flag--remote_upload_local_results
-common --remote_upload_local_results
-
-# Fall back to standalone local execution strategy if remote execution fails. If the grpc remote
-# cache connection fails, it will fail the build, add this so it falls back to the local cache.
-# Docs: https://bazel.build/reference/command-line-reference#flag--remote_local_fallback
-common --remote_local_fallback
-
-# Fixes builds hanging on CI that get the TCP connection closed without sending RST packets.
-# Docs: https://bazel.build/reference/command-line-reference#flag--grpc_keepalive_time
-common --grpc_keepalive_time=30s
diff --git a/.aspect/bazelrc/convenience.bazelrc b/.aspect/bazelrc/convenience.bazelrc
deleted file mode 100644
index ec878471..00000000
--- a/.aspect/bazelrc/convenience.bazelrc
+++ /dev/null
@@ -1,28 +0,0 @@
-# Attempt to build & test every target whose prerequisites were successfully built.
-# Docs: https://bazel.build/docs/user-manual#keep-going
-common --keep_going
-
-# Output test errors to stderr so users don't have to `cat` or open test failure log files when test
-# fail. This makes the log noisier in exchange for reducing the time-to-feedback on test failures for
-# users.
-# Docs: https://bazel.build/docs/user-manual#test-output
-common --test_output=errors
-
-# Show the output files created by builds that requested more than one target. This helps users
-# locate the build outputs in more cases
-# Docs: https://bazel.build/docs/user-manual#show-result
-common --show_result=20
-
-# Bazel picks up host-OS-specific config lines from bazelrc files. For example, if the host OS is
-# Linux and you run bazel build, Bazel picks up lines starting with build:linux. Supported OS
-# identifiers are `linux`, `macos`, `windows`, `freebsd`, and `openbsd`. Enabling this flag is
-# equivalent to using `--config=linux` on Linux, `--config=windows` on Windows, etc.
-# Docs: https://bazel.build/reference/command-line-reference#flag--enable_platform_specific_config
-common --enable_platform_specific_config
-
-# Output a heap dump if an OOM is thrown during a Bazel invocation
-# (including OOMs due to `--experimental_oom_more_eagerly_threshold`).
-# The dump will be written to `<output_base>/<invocation_id>.heapdump.hprof`.
-# You may need to configure CI to capture this artifact and upload for later use.
-# Docs: https://bazel.build/reference/command-line-reference#flag--heap_dump_on_oom
-common --heap_dump_on_oom
diff --git a/.aspect/bazelrc/correctness.bazelrc b/.aspect/bazelrc/correctness.bazelrc
deleted file mode 100644
index 8248d636..00000000
--- a/.aspect/bazelrc/correctness.bazelrc
+++ /dev/null
@@ -1,64 +0,0 @@
-# Do not upload locally executed action results to the remote cache.
-# This should be the default for local builds so local builds cannot poison the remote cache.
-# It should be flipped to `--remote_upload_local_results` on CI
-# by using `--bazelrc=.aspect/bazelrc/ci.bazelrc`.
-# Docs: https://bazel.build/reference/command-line-reference#flag--remote_upload_local_results
-common --noremote_upload_local_results
-
-# Don't allow network access for build actions in the sandbox.
-# Ensures that you don't accidentally make non-hermetic actions/tests which depend on remote
-# services.
-# Developers should tag targets with `tags=["requires-network"]` to opt-out of the enforcement.
-# Docs: https://bazel.build/reference/command-line-reference#flag--sandbox_default_allow_network
-common --sandbox_default_allow_network=false
-
-# Warn if a test's timeout is significantly longer than the test's actual execution time.
-# Bazel's default for test_timeout is medium (5 min), but most tests should instead be short (1 min).
-# While a test's timeout should be set such that it is not flaky, a test that has a highly
-# over-generous timeout can hide real problems that crop up unexpectedly.
-# For instance, a test that normally executes in a minute or two should not have a timeout of
-# ETERNAL or LONG as these are much, much too generous.
-# Docs: https://bazel.build/docs/user-manual#test-verbose-timeout-warnings
-common --test_verbose_timeout_warnings
-
-# Allow the Bazel server to check directory sources for changes. Ensures that the Bazel server
-# notices when a directory changes, if you have a directory listed in the srcs of some target.
-# Recommended when using
-# [copy_directory](https://github.com/bazel-contrib/bazel-lib/blob/main/docs/copy_directory.md) and
-# [rules_js](https://github.com/aspect-build/rules_js) since npm package are source directories
-# inputs to copy_directory actions.
-# Docs: https://bazel.build/reference/command-line-reference#flag--host_jvm_args
-startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
-
-# Allow exclusive tests to run in the sandbox. Fixes a bug where Bazel doesn't enable sandboxing for
-# tests with `tags=["exclusive"]`.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_exclusive_test_sandboxed
-common --incompatible_exclusive_test_sandboxed
-
-# Use a static value for `PATH` and does not inherit `LD_LIBRARY_PATH`. Doesn't let environment
-# variables like `PATH` sneak into the build, which can cause massive cache misses when they change.
-# Use `--action_env=ENV_VARIABLE` if you want to inherit specific environment variables from the
-# client, but note that doing so can prevent cross-user caching if a shared cache is used.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_strict_action_env
-common --incompatible_strict_action_env
-
-# Do not automatically create `__init__.py` files in the runfiles of Python targets. Fixes the wrong
-# default that comes from Google's internal monorepo by using `__init__.py` to delimit a Python
-# package. Precisely, when a `py_binary` or `py_test` target has `legacy_create_init` set to `auto (the
-# default), it is treated as false if and only if this flag is set. See
-# https://github.com/bazelbuild/bazel/issues/10076.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_default_to_explicit_init_py
-common --incompatible_default_to_explicit_init_py
-
-# Set default value of `allow_empty` to `False` in `glob()`. This prevents a common mistake when
-# attempting to use `glob()` to match files in a subdirectory that is opaque to the current package
-# because it contains a BUILD file. See https://github.com/bazelbuild/bazel/issues/8195.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_disallow_empty_glob
-common --incompatible_disallow_empty_glob
-
-# Always download coverage files for tests from the remote cache. By default, coverage files are not
-# downloaded on test result cache hits when --remote_download_minimal is enabled, making it impossible
-# to generate a full coverage report.
-# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_fetch_all_coverage_outputs
-# ditching remote cache results
-common --experimental_fetch_all_coverage_outputs
diff --git a/.aspect/bazelrc/debug.bazelrc b/.aspect/bazelrc/debug.bazelrc
deleted file mode 100644
index 11f8c646..00000000
--- a/.aspect/bazelrc/debug.bazelrc
+++ /dev/null
@@ -1,19 +0,0 @@
-############################################################
-# Use `bazel test --config=debug` to enable these settings #
-############################################################
-
-# Stream stdout/stderr output from each test in real-time.
-# Docs: https://bazel.build/docs/user-manual#test-output
-common:debug --test_output=streamed
-
-# Run one test at a time.
-# Docs: https://bazel.build/reference/command-line-reference#flag--test_strategy
-common:debug --test_strategy=exclusive
-
-# Prevent long running tests from timing out.
-# Docs: https://bazel.build/docs/user-manual#test-timeout
-common:debug --test_timeout=9999
-
-# Always run tests even if they have cached results.
-# Docs: https://bazel.build/docs/user-manual#cache-test-results
-common:debug --nocache_test_results
diff --git a/.aspect/bazelrc/java.bazelrc b/.aspect/bazelrc/java.bazelrc
deleted file mode 100644
index 9a3532aa..00000000
--- a/.aspect/bazelrc/java.bazelrc
+++ /dev/null
@@ -1,27 +0,0 @@
-# Aspect recommended Bazel flags when using rules_java and rules_jvm_external
-
-# Pin java versions to desired language level
-# See https://bazel.build/docs/bazel-and-java#java-versions
-# and https://en.wikipedia.org/wiki/Java_version_history
-
-# What version of Java are the source files in this repo?
-# See https://bazel.build/docs/user-manual#java-language-version
-common --java_language_version=17
-
-# The Java language version used to build tools that are executed during a build
-# See https://bazel.build/docs/user-manual#tool-java-language-version
-common --tool_java_language_version=17
-
-# The version of JVM to use to execute the code and run the tests.
-# NB: The default value is local_jdk which is non-hermetic.
-# See https://bazel.build/docs/user-manual#java-runtime-version
-common --java_runtime_version=remotejdk_17
-
-# The version of JVM used to execute tools that are needed during a build.
-# See https://bazel.build/docs/user-manual#tool-java-runtime-version
-common --tool_java_runtime_version=remotejdk_17
-
-# Repository rules, such as rules_jvm_external: put Bazel's JDK on the path.
-# Avoids non-hermeticity from dependency on a JAVA_HOME pointing at a system JDK
-# see https://github.com/bazelbuild/rules_jvm_external/issues/445
-common --repo_env=JAVA_HOME=../bazel_tools/jdk
diff --git a/.aspect/bazelrc/javascript.bazelrc b/.aspect/bazelrc/javascript.bazelrc
deleted file mode 100644
index 2afd3176..00000000
--- a/.aspect/bazelrc/javascript.bazelrc
+++ /dev/null
@@ -1,11 +0,0 @@
-# Aspect recommended Bazel flags when using Aspect's JavaScript rules: https://github.com/aspect-build/rules_js
-# Docs for Node.js flags: https://nodejs.org/en/docs/guides/debugging-getting-started/#command-line-options
-
-# Support for debugging Node.js tests. Use bazel run with `--config=debug` to turn on the NodeJS
-# inspector agent. The node process will break before user code starts and wait for the debugger to
-# connect. Pass the --inspect-brk option to all tests which enables the node inspector agent. See
-# https://nodejs.org/de/docs/guides/debugging-getting-started/#command-line-options for more
-# details.
-# Docs: https://nodejs.org/en/docs/guides/debugging-getting-started/#command-line-options
-run:debug -- --node_options=--inspect-brk
-common:debug --test_env=NODE_OPTIONS=--inspect-brk
diff --git a/.aspect/bazelrc/performance.bazelrc b/.aspect/bazelrc/performance.bazelrc
deleted file mode 100644
index 1a9a20b3..00000000
--- a/.aspect/bazelrc/performance.bazelrc
+++ /dev/null
@@ -1,19 +0,0 @@
-# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
-# Save time on Sandbox creation and deletion when many of the same kind of action run during the
-# build.
-# No longer experimental in Bazel 6: https://github.com/bazelbuild/bazel/commit/c1a95501a5611878e5cc43a3cc531f2b9e47835b
-# Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
-common --experimental_reuse_sandbox_directories
-
-# Avoid creating a runfiles tree for binaries or tests until it is needed.
-# Docs: https://bazel.build/reference/command-line-reference#flag--build_runfile_links
-# See https://github.com/bazelbuild/bazel/issues/6627
-#
-# This may break local workflows that `build` a binary target, then run the resulting program
-# outside of `bazel run`. In those cases, the script will need to call
-# `bazel build --build_runfile_links //my/binary:target` and then execute the resulting program.
-common --nobuild_runfile_links
-
-# Needed prior to Bazel 8; see
-# https://github.com/bazelbuild/bazel/issues/20577
-coverage --build_runfile_links
diff --git a/.bazelrc b/.bazelrc
index 4e2ab675..5c68c893 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,10 +1,8 @@
-# Import Aspect bazelrc presets
-try-import %workspace%/.aspect/bazelrc/bazel7.bazelrc # will only work in bazel7+
-import %workspace%/.aspect/bazelrc/bazel6.bazelrc # will only work in bazel6+
-import %workspace%/.aspect/bazelrc/convenience.bazelrc
-import %workspace%/.aspect/bazelrc/correctness.bazelrc
-import %workspace%/.aspect/bazelrc/debug.bazelrc
-import %workspace%/.aspect/bazelrc/performance.bazelrc
+# Import default settings
+import %workspace%/tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 # Specific project flags go here if we have some
 common --incompatible_enable_proto_toolchain_resolution
diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml
index b3ed4e0b..1cb4784e 100644
--- a/.github/workflows/action.yml
+++ b/.github/workflows/action.yml
@@ -26,25 +26,16 @@ jobs:
         disk-cache: true
         # Share repository cache between workflows.
         repository-cache: true
-        # enable some flags for CI
-        bazelrc: |
-          import %workspace%/.aspect/bazelrc/ci.bazelrc
-          import %workspace%/.github/workflows/ci.bazelrc
         # keep a cache for MODULE.bazel repos
         external-cache: true
-    - run: bazelisk build //... && bazelisk test //...
+    - run: bazelisk build --config=ci //... && bazelisk test --config=ci //...
 
   e2e-workspace-matrix:
     strategy:
       matrix:
         version:
           - version: 6.x
-            bazelrc: |
-              import %workspace%/../../.aspect/bazelrc/bazel6.bazelrc
           - version: 7.x
-            bazelrc: |
-              import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
-              import %workspace%/../../.aspect/bazelrc/bazel6.bazelrc
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -56,12 +47,7 @@ jobs:
         disk-cache: true
         # Share repository cache between workflows.
         repository-cache: true
-        # enable some flags for CI
-        bazelrc: |
-          import %workspace%/../../.aspect/bazelrc/ci.bazelrc
-          import %workspace%/../../.github/workflows/ci.bazelrc
-          ${{ matrix.version.bazelrc }}
-    - run: cd e2e/bazel-workspace && USE_BAZEL_VERSION=${{ matrix.version.version }} bazelisk build //...
+    - run: cd e2e/bazel-workspace && USE_BAZEL_VERSION=${{ matrix.version.version }} bazelisk build --config=ci //...
 
   e2e-bzlmod-matrix:
     strategy:
@@ -82,11 +68,7 @@ jobs:
         disk-cache: true
         # Share repository cache between workflows.
         repository-cache: true
-        # enable some flags for CI
-        bazelrc: |
-          import %workspace%/../../.aspect/bazelrc/ci.bazelrc
-          import %workspace%/../../.github/workflows/ci.bazelrc
-    - run: cd e2e/${{ matrix.path }} && USE_BAZEL_VERSION=${{ matrix.version }} bazelisk build //...
+    - run: cd e2e/${{ matrix.path }} && USE_BAZEL_VERSION=${{ matrix.version }} bazelisk build --config=ci //...
 
   e2e-bzlmod-build-toolchain-matrix:
     strategy:
@@ -104,11 +86,7 @@ jobs:
         disk-cache: true
         # Share repository cache between workflows.
         repository-cache: true
-        # enable some flags for CI
-        bazelrc: |
-          import %workspace%/../../.aspect/bazelrc/ci.bazelrc
-          import %workspace%/../../.github/workflows/ci.bazelrc
-    - run: cd e2e/bazel-bzlmod-toolchain-from-source && USE_BAZEL_VERSION=${{ matrix.version }} bazelisk build //...
+    - run: cd e2e/bazel-bzlmod-toolchain-from-source && USE_BAZEL_VERSION=${{ matrix.version }} bazelisk build --config=ci //...
 
   e2e-repo-yaml:
     runs-on: ubuntu-latest
@@ -122,15 +100,11 @@ jobs:
         disk-cache: true
         # Share repository cache between workflows.
         repository-cache: true
-        # enable some flags for CI
-        bazelrc: |
-          import %workspace%/.aspect/bazelrc/ci.bazelrc
-          import %workspace%/.github/workflows/ci.bazelrc
     - run: |
         export USE_BAZEL_VERSION=7.x
-        bazelisk run //cmd -- init --fc 41 --output $(pwd)/repo.yaml
-        bazelisk run //cmd -- fetch --repofile $(pwd)/repo.yaml
-        bazelisk run //cmd -- resolve --repofile $(pwd)/repo.yaml bash
+        bazelisk run --config=ci //cmd -- init --fc 41 --output $(pwd)/repo.yaml
+        bazelisk run --config=ci //cmd -- fetch --repofile $(pwd)/repo.yaml
+        bazelisk run --config=ci //cmd -- resolve --repofile $(pwd)/repo.yaml bash
 
   e2e-bzlmod-lock-file-from-args:
     runs-on: ubuntu-latest
@@ -145,12 +119,13 @@ jobs:
         # Share repository cache between workflows.
         repository-cache: true
         # enable some flags for CI
-        bazelrc: |
-          import %workspace%/../../.aspect/bazelrc/ci.bazelrc
-          import %workspace%/../../.github/workflows/ci.bazelrc
     - run: |
         export USE_BAZEL_VERSION=8.x
-        cd e2e/bazel-bzlmod-lock-file-from-args && bazelisk run :bazeldnf -- fetch && bazelisk run @bazeldnf_rpms//:update-lock-file && bazelisk build ...
+        set -eou pipefail
+        cd e2e/bazel-bzlmod-lock-file-from-args
+        bazelisk run  --config=ci :bazeldnf -- fetch
+        bazelisk run  --config=ci @bazeldnf_rpms//:update-lock-file
+        bazelisk build --config=ci  ...
 
   e2e-bzlmod-toolchain-circular-dependencies:
     runs-on: ubuntu-latest
@@ -164,21 +139,17 @@ jobs:
         disk-cache: true
         # Share repository cache between workflows.
         repository-cache: true
-        # enable some flags for CI
-        bazelrc: |
-          import %workspace%/../../.aspect/bazelrc/ci.bazelrc
-          import %workspace%/../../.github/workflows/ci.bazelrc
     - id: prepare
       run: |
         export USE_BAZEL_VERSION=8.x
         cd e2e/bzlmod-toolchain-circular-dependencies
-        bazelisk run @bazeldnf_rpms//:fetch-repo
-        bazelisk run @bazeldnf_rpms//:update-lock-file
+        bazelisk run --config=ci @bazeldnf_rpms//:fetch-repo
+        bazelisk run --config=ci @bazeldnf_rpms//:update-lock-file
     - id: test
       run: |
         export USE_BAZEL_VERSION=8.x
         cd e2e/bzlmod-toolchain-circular-dependencies
-        bazelisk build //... || status=$?
+        bazelisk build --config=ci //... || status=$?
         if [ ${status} -ne 0 ]; then
           echo "::warning::Optional job failed."
           echo "optional_fail=true" >> "${GITHUB_OUTPUT}"
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
deleted file mode 100644
index 22056f36..00000000
--- a/.github/workflows/ci.bazelrc
+++ /dev/null
@@ -1,6 +0,0 @@
-# this settings are extra to the ones from .aspect/bazelrc/ci.bazelrc
-# we don't put it there as otherwise the test to keep flags up to date will
-# always fail
-
-# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
-common --test_env=XDG_CACHE_HOME
diff --git a/.github/workflows/linter.yaml b/.github/workflows/linter.yaml
index bbc8125e..2cc2e3ce 100644
--- a/.github/workflows/linter.yaml
+++ b/.github/workflows/linter.yaml
@@ -30,12 +30,9 @@ jobs:
           disk-cache: true
           # Share repository cache between workflows.
           repository-cache: true
-          bazelrc: |
-            import %workspace%/.aspect/bazelrc/ci.bazelrc
-            import %workspace%/.github/workflows/ci.bazelrc
           # keep a cache for MODULE.bazel repos
           external-cache: true
       - name: buildifier
-        run: bazel run //:buildifier.check
+        run: bazel run --config=ci //:buildifier.check
       - name: gazelle
-        run: bazel run //:gazelle.check
+        run: bazel run --config=ci //:gazelle.check
diff --git a/MODULE.bazel b/MODULE.bazel
index aba19051..c9a379a2 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -95,7 +95,8 @@ use_repo(protoc, "toolchains_protoc_hub")
 
 # deps only needed for the repo internals
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.8.2", dev_dependency = True)
-bazel_dep(name = "aspect_bazel_lib", version = "2.21.2", dev_dependency = True)
+bazel_dep(name = "bazel_lib", version = "3.1.1", dev_dependency = True)
+bazel_dep(name = "bazelrc-preset.bzl", version = "1.9.2", dev_dependency = True)
 bazel_dep(name = "buildifier_prebuilt", version = "8.2.1", dev_dependency = True)
 bazel_dep(name = "rules_pkg", version = "1.1.0", dev_dependency = True)
 bazel_dep(name = "stardoc", version = "0.8.0", dev_dependency = True)
diff --git a/e2e/bazel-bzlmod-lock-file-from-args/.bazelrc b/e2e/bazel-bzlmod-lock-file-from-args/.bazelrc
index 6b6c94e8..ca878276 100644
--- a/e2e/bazel-bzlmod-lock-file-from-args/.bazelrc
+++ b/e2e/bazel-bzlmod-lock-file-from-args/.bazelrc
@@ -1,9 +1,7 @@
-# Import Aspect bazelrc presets
-try-import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
-import %workspace%/../../.aspect/bazelrc/convenience.bazelrc
-import %workspace%/../../.aspect/bazelrc/correctness.bazelrc
-import %workspace%/../../.aspect/bazelrc/debug.bazelrc
-import %workspace%/../../.aspect/bazelrc/performance.bazelrc
+import %workspace%/../../tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 # Specific project flags go here if we have some
 common --enable_bzlmod
diff --git a/e2e/bazel-bzlmod-lock-file/.bazelrc b/e2e/bazel-bzlmod-lock-file/.bazelrc
index 0b8b0486..7e3d51d9 100644
--- a/e2e/bazel-bzlmod-lock-file/.bazelrc
+++ b/e2e/bazel-bzlmod-lock-file/.bazelrc
@@ -1,9 +1,7 @@
-# Import Aspect bazelrc presets
-try-import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
-import %workspace%/../../.aspect/bazelrc/convenience.bazelrc
-import %workspace%/../../.aspect/bazelrc/correctness.bazelrc
-import %workspace%/../../.aspect/bazelrc/debug.bazelrc
-import %workspace%/../../.aspect/bazelrc/performance.bazelrc
+import %workspace%/../../tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 common --enable_bzlmod
 common --extra_toolchains=@bazeldnf//cmd:bazeldnf-host-toolchain
diff --git a/e2e/bazel-bzlmod-lock-file/.bazelversion b/e2e/bazel-bzlmod-lock-file/.bazelversion
new file mode 100644
index 00000000..c6b7980b
--- /dev/null
+++ b/e2e/bazel-bzlmod-lock-file/.bazelversion
@@ -0,0 +1 @@
+8.x
diff --git a/e2e/bazel-bzlmod-toolchain-from-source-lock-file/.bazelrc b/e2e/bazel-bzlmod-toolchain-from-source-lock-file/.bazelrc
index b54eb05e..ca878276 100644
--- a/e2e/bazel-bzlmod-toolchain-from-source-lock-file/.bazelrc
+++ b/e2e/bazel-bzlmod-toolchain-from-source-lock-file/.bazelrc
@@ -1,10 +1,7 @@
-# Import Aspect bazelrc presets
-try-import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
-import %workspace%/../../.aspect/bazelrc/bazel6.bazelrc
-import %workspace%/../../.aspect/bazelrc/convenience.bazelrc
-import %workspace%/../../.aspect/bazelrc/correctness.bazelrc
-import %workspace%/../../.aspect/bazelrc/debug.bazelrc
-import %workspace%/../../.aspect/bazelrc/performance.bazelrc
+import %workspace%/../../tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 # Specific project flags go here if we have some
 common --enable_bzlmod
diff --git a/e2e/bazel-bzlmod-toolchain-from-source/.bazelrc b/e2e/bazel-bzlmod-toolchain-from-source/.bazelrc
index 449a334f..80d71be3 100644
--- a/e2e/bazel-bzlmod-toolchain-from-source/.bazelrc
+++ b/e2e/bazel-bzlmod-toolchain-from-source/.bazelrc
@@ -1,9 +1,7 @@
-# Import Aspect bazelrc presets
-try-import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
-import %workspace%/../../.aspect/bazelrc/convenience.bazelrc
-import %workspace%/../../.aspect/bazelrc/correctness.bazelrc
-import %workspace%/../../.aspect/bazelrc/debug.bazelrc
-import %workspace%/../../.aspect/bazelrc/performance.bazelrc
+import %workspace%/../../tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 # Specific project flags go here if we have some
 common --enable_bzlmod
diff --git a/e2e/bazel-bzlmod-toolchain-from-source/.bazelversion b/e2e/bazel-bzlmod-toolchain-from-source/.bazelversion
new file mode 100644
index 00000000..c6b7980b
--- /dev/null
+++ b/e2e/bazel-bzlmod-toolchain-from-source/.bazelversion
@@ -0,0 +1 @@
+8.x
diff --git a/e2e/bazel-bzlmod/.bazelrc b/e2e/bazel-bzlmod/.bazelrc
index 6d22ade3..5df4080d 100644
--- a/e2e/bazel-bzlmod/.bazelrc
+++ b/e2e/bazel-bzlmod/.bazelrc
@@ -1,9 +1,7 @@
-# Import Aspect bazelrc presets
-try-import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
-import %workspace%/../../.aspect/bazelrc/convenience.bazelrc
-import %workspace%/../../.aspect/bazelrc/correctness.bazelrc
-import %workspace%/../../.aspect/bazelrc/debug.bazelrc
-import %workspace%/../../.aspect/bazelrc/performance.bazelrc
+import %workspace%/../../tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 common --enable_bzlmod
 
diff --git a/e2e/bazel-workspace/.bazelrc b/e2e/bazel-workspace/.bazelrc
index 33dee036..33c39ff9 100644
--- a/e2e/bazel-workspace/.bazelrc
+++ b/e2e/bazel-workspace/.bazelrc
@@ -1,8 +1,7 @@
-# Import Aspect bazelrc presets
-import %workspace%/../../.aspect/bazelrc/convenience.bazelrc
-import %workspace%/../../.aspect/bazelrc/correctness.bazelrc
-import %workspace%/../../.aspect/bazelrc/debug.bazelrc
-import %workspace%/../../.aspect/bazelrc/performance.bazelrc
+import %workspace%/../../tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 # Specific project flags go here if we have some
 
diff --git a/e2e/bzlmod-toolchain-circular-dependencies/.bazelrc b/e2e/bzlmod-toolchain-circular-dependencies/.bazelrc
index 6b6c94e8..ca878276 100644
--- a/e2e/bzlmod-toolchain-circular-dependencies/.bazelrc
+++ b/e2e/bzlmod-toolchain-circular-dependencies/.bazelrc
@@ -1,9 +1,7 @@
-# Import Aspect bazelrc presets
-try-import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
-import %workspace%/../../.aspect/bazelrc/convenience.bazelrc
-import %workspace%/../../.aspect/bazelrc/correctness.bazelrc
-import %workspace%/../../.aspect/bazelrc/debug.bazelrc
-import %workspace%/../../.aspect/bazelrc/performance.bazelrc
+import %workspace%/../../tools/preset.bazelrc
+
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+common:ci --test_env=XDG_CACHE_HOME
 
 # Specific project flags go here if we have some
 common --enable_bzlmod
diff --git a/tools/BUILD.bazel b/tools/BUILD.bazel
index 21c8b592..33f74615 100644
--- a/tools/BUILD.bazel
+++ b/tools/BUILD.bazel
@@ -1,4 +1,11 @@
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+load("@bazelrc-preset.bzl", "bazelrc_preset")
+load(":preset.bzl", "EXTRA_PRESET_FLAGS")
+
+bazelrc_preset(
+    name = "preset",
+    extra_presets = EXTRA_PRESET_FLAGS,
+)
 
 bzl_library(
     name = "integrity",
diff --git a/tools/preset.bazelrc b/tools/preset.bazelrc
new file mode 100644
index 00000000..f4c1d75d
--- /dev/null
+++ b/tools/preset.bazelrc
@@ -0,0 +1,246 @@
+# Generated by bazelrc-preset.bzl
+# To update this file, run:
+#   bazel run @@//tools:preset.update
+
+# On CI, announce all announces command options read from the bazelrc file(s) when starting up at the
+# beginning of each Bazel invocation. This is very useful on CI to be able to inspect which flags
+# are being applied on each run based on the order of overrides.
+common:ci --announce_rc
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=announce_rc
+
+# Avoid creating a runfiles tree for binaries or tests until it is needed.
+# See https://github.com/bazelbuild/bazel/issues/6627
+# This may break local workflows that `build` a binary target, then run the resulting program outside of `bazel run`.
+# In those cases, the script will need to call `bazel build --build_runfile_links //my/binary:target` and then execute the resulting program.
+common --nobuild_runfile_links
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=build_runfile_links
+
+# See https://github.com/bazelbuild/bazel/issues/20577
+coverage --build_runfile_links
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=build_runfile_links
+
+# Always run tests even if they have cached results.
+# This ensures tests are executed fresh each time, useful for debugging and ensuring test reliability.
+common:debug --nocache_test_results
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=cache_test_results
+
+# Don’t encourage a rules author to update their deps if not needed.
+# These bazel_dep calls should indicate the minimum version constraint of the ruleset.
+# If the author instead updates to the newest of any of their transitives, as this flag would suggest,
+# then they'll also force their dependents to a newer version.
+# Context:
+# https://bazelbuild.slack.com/archives/C014RARENH0/p1691158021917459?thread_ts=1691156601.420349&cid=C014RARENH0
+common:ruleset --check_direct_dependencies="off"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=check_direct_dependencies
+
+# On CI, use colors to highlight output on the screen. Set to `no` if your CI does not display colors.
+common:ci --color="yes"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=color
+
+# On CI, use cursor controls in screen output.
+common:ci --curses="yes"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=curses
+
+# Bazel picks up host-OS-specific config lines from bazelrc files. For example, if the host OS is
+# Linux and you run bazel build, Bazel picks up lines starting with build:linux. Supported OS
+# identifiers are `linux`, `macos`, `windows`, `freebsd`, and `openbsd`. Enabling this flag is
+# equivalent to using `--config=linux` on Linux, `--config=windows` on Windows, etc.
+common --enable_platform_specific_config
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=enable_platform_specific_config
+
+# Speed up all builds by not checking if external repository files have been modified.
+# For reference: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
+common --noexperimental_check_external_repository_files
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=experimental_check_external_repository_files
+
+# Always download coverage files for tests from the remote cache. By default, coverage files are not
+# downloaded on test result cache hits when --remote_download_minimal is enabled, making it impossible
+# to generate a full coverage report.
+common --experimental_fetch_all_coverage_outputs
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=experimental_fetch_all_coverage_outputs
+
+# This flag was added in Bazel 6.2.0 with a default of zero:
+# https://github.com/bazelbuild/bazel/commit/24b45890c431de98d586fdfe5777031612049135
+# For Bazel 8.0.0rc1 the default was changed to 5:
+# https://github.com/bazelbuild/bazel/commit/739e37de66f4913bec1a55b2f2a162e7db6f2d0f
+# Back-port the updated flag default value to older Bazel versions.
+common --experimental_remote_cache_eviction_retries=5
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=experimental_remote_cache_eviction_retries
+
+# Discard Merkle trees for remote actions reducing memory usage significantly.
+# Requires Bazel to recompute them upon remote cache misses and retries.
+common --experimental_remote_discard_merkle_trees
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=experimental_remote_discard_merkle_trees
+
+# This flag was added in Bazel 5.0.0 with a default of zero:
+# https://github.com/bazelbuild/bazel/commit/a1137ec1338d9549fd34a9a74502ffa58c286a8e
+# For Bazel 8.0.0 the default was changed to 5:
+# https://github.com/bazelbuild/bazel/commit/9335cf989ee6a678ca10bc4da72214634cef0a57
+# Back-port the updated flag default value to older Bazel versions.
+common --experimental_repository_downloader_retries=5
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=experimental_repository_downloader_retries
+
+# Set this flag to enable re-tries of failed tests on CI.
+# When any test target fails, try one or more times. This applies regardless of whether the "flaky"
+# tag appears on the target definition.
+# This is a tradeoff: legitimately failing tests will take longer to report,
+# but we can "paper over" flaky tests that pass most of the time.
+#
+# An alternative is to mark every flaky test with the `flaky = True` attribute, but this requires
+# the buildcop to make frequent code edits.
+# This flag is not recommended for local builds: flakiness is more likely to get fixed if it is
+# observed during development.
+#
+# Note that when passing after the first attempt, Bazel will give a special "FLAKY" status rather than "PASSED".
+test:ci --flaky_test_attempts=2
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=flaky_test_attempts
+
+# Fixes builds hanging on CI that get the TCP connection closed without sending RST packets.
+common:ci --grpc_keepalive_time="30s"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=grpc_keepalive_time
+
+# Output a heap dump if an OOM is thrown during a Bazel invocation
+# (including OOMs due to `--experimental_oom_more_eagerly_threshold`).
+# The dump will be written to `<output_base>/<invocation_id>.heapdump.hprof`.
+# You should configure CI to upload this artifact for later inspection.
+common --heap_dump_on_oom
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=heap_dump_on_oom
+
+# Allow the Bazel server to check directory sources for changes. Ensures that the Bazel server
+# notices when a directory changes, if you have a directory listed in the srcs of some target.
+# Recommended when using [copy_directory](https://github.com/bazel-contrib/bazel-lib/blob/main/docs/copy_directory.md)
+# and [rules_js](https://github.com/aspect-build/rules_js) since npm package are source directories inputs to copy_directory actions.
+startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=host_jvm_args
+
+# By default, Bazel automatically creates __init__.py files for py_binary and py_test targets.
+# From https://github.com/bazelbuild/bazel/issues/10076:
+# > It is magic at a distance.
+# > Python programmers are already used to creating __init__.py files in their source trees,
+# > so doing it behind their backs introduces confusion and changes the semantics of imports
+common --incompatible_default_to_explicit_init_py
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=incompatible_default_to_explicit_init_py
+
+# Disallow empty glob patterns.
+# The glob() function tends to be error-prone, because any typo in a path will silently return an empty list.
+# This flag was added in Bazel 0.27 and flipped in Bazel 8: https://github.com/bazelbuild/bazel/issues/8195
+common --incompatible_disallow_empty_glob
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=incompatible_disallow_empty_glob
+
+# Make builds more reproducible by using a static value for PATH and not inheriting LD_LIBRARY_PATH.
+# Use `--action_env=ENV_VARIABLE` if you want to inherit specific variables from the environment where Bazel runs.
+# Note that doing so can prevent cross-user caching if a shared cache is used.
+# See https://github.com/bazelbuild/bazel/issues/2574 for more details.
+common --incompatible_strict_action_env
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=incompatible_strict_action_env
+
+# Performance improvement: avoid laying out a second copy of the runfiles tree.
+# See https://github.com/bazelbuild/bazel/issues/23574.
+# This flag was flipped for Bazel 8.
+common --nolegacy_external_runfiles
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=legacy_external_runfiles
+
+# bazeldnf CI tests against multiple bazel versions, so we can't be strict with MODULE.bazel
+common:ci --lockfile_mode="update"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=lockfile_mode
+
+# On CI, don't download remote outputs to the local machine.
+# Most CI pipelines don't need to access the files and they can remain at rest on the remote cache.
+# Significant time can be spent on needless downloads, which is especially noticeable on fully-cached builds.
+#
+# If you do need to download files, the fastest options are:
+# - (preferred) Use `remote_download_regex` to specify the files to download.
+# - Use the Remote Output Service (https://blog.bazel.build/2024/07/23/remote-output-service.html)
+# to lazy-materialize specific files after the build completes.
+# - Perform a second bazel command with specific targets and override this flag with the `toplevel` value.
+# - To copy executable targets, you can use `bazel run --run_under=cp //some:binary_target <destination path>`.
+common:ci --remote_download_outputs="minimal"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=remote_download_outputs
+
+# On CI, fall back to standalone local execution strategy if remote execution fails.
+# Otherwise, when a grpc remote cache connection fails, it would fail the build.
+common:ci --remote_local_fallback
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=remote_local_fallback
+
+# On CI, extend the maximum amount of time to wait for remote execution and cache calls.
+common:ci --remote_timeout=3600
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=remote_timeout
+
+# Do not upload locally executed action results to the remote cache.
+# This should be the default for local builds so local builds cannot poison the remote cache.
+#
+# Note that this flag is flipped to True under --config=ci, see below.
+common --noremote_upload_local_results
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=remote_upload_local_results
+
+# On CI, upload locally executed action results to the remote cache.
+common:ci --remote_upload_local_results
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=remote_upload_local_results
+
+# Repository rules, such as rules_jvm_external: put Bazel's JDK on the path.
+# Avoids non-hermeticity from dependency on a JAVA_HOME pointing at a system JDK
+# see https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env="JAVA_HOME=../bazel_tools/jdk"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=repo_env
+
+# Reuse sandbox directories between invocations.
+# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
+# Saves time on sandbox creation and deletion when many of the same kind of action is spawned during the build.
+common --reuse_sandbox_directories
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=reuse_sandbox_directories
+
+# Don't allow network access for build actions in the sandbox by default.
+# Avoids accidental non-hermeticity in actions/tests which depend on remote services.
+# Developers should tag targets with `tags=["requires-network"]` to be explicit that they need network access.
+# Note that the sandbox cannot print a message to the console if it denies network access,
+# so failures under this flag appear as application errors in the networking layer.
+common --nosandbox_default_allow_network
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=sandbox_default_allow_network
+
+# Only show progress every 60 seconds on CI.
+# We want to find a compromise between printing often enough to show that the build isn't stuck,
+# but not so often that we produce a long log file that requires a lot of scrolling.
+common:ci --show_progress_rate_limit=60
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=show_progress_rate_limit
+
+# The printed files are convenient strings for copy+pasting to the shell, to execute them.
+# This option requires an integer argument, which is the threshold number of targets above which result information is not printed.
+# Show the output files created by builds that requested more than one target.
+# This helps users locate the build outputs in more cases.
+common --show_result=20
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=show_result
+
+# On CI, add a timestamp to each message generated by Bazel specifying the time at which the message was displayed.
+# This makes it easier to reason about what were the slowest steps on CI.
+common:ci --show_timestamps
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=show_timestamps
+
+# The terminal width in columns. Configure this to override the default value based on what your CI system renders.
+common:ci --terminal_columns=143
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=terminal_columns
+
+# Output test errors to stderr so users don't have to `cat` or open test failure log files when test fail.
+# This makes the log noisier in exchange for reducing the time-to-feedback on test failures for users.
+common --test_output="errors"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=test_output
+
+# Stream stdout/stderr output from each test in real-time.
+# This provides immediate feedback during test execution, useful for debugging test failures.
+common:debug --test_output="streamed"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=test_output
+
+# Run one test at a time in exclusive mode.
+# This prevents test interference and provides clearer output when debugging test issues.
+common:debug --test_strategy="exclusive"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=test_strategy
+
+# The default test_summary ("short") prints a result for every test target that was executed.
+# In a large repo this amounts to hundreds of lines of additional log output when testing a broad wildcard pattern like //...
+# This value means to print information only about unsuccessful tests that were run.
+test:ci --test_summary="terse"
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=test_summary
+
+# Prevent long running tests from timing out.
+# Set to a high value to allow tests to complete even if they take longer than expected.
+common:debug --test_timeout=9999
+# Docs: https://registry.build/flag/bazel@7.7.1?filter=test_timeout
diff --git a/tools/preset.bzl b/tools/preset.bzl
new file mode 100644
index 00000000..b8810d1c
--- /dev/null
+++ b/tools/preset.bzl
@@ -0,0 +1,18 @@
+"""override flags from preset.bzl
+
+For the bazeldnf we need some special flags to not use the recommended defaults
+"""
+EXTRA_PRESET_FLAGS = {
+    "lockfile_mode": struct(
+        command = "common:ci",
+        default = "update",
+        description = """\
+        bazeldnf CI tests against multiple bazel versions, so we can't be strict with MODULE.bazel
+        """,
+    ),
+    "incompatible_modify_execution_info_additive": struct(
+        default = True,
+        if_bazel_version = False,  # hack: this flag is not supported by Bazel 6 and having it mentioned breaks bazeldnf CI
+        description = "Accept multiple --modify_execution_info flags, rather than the last flag overwriting earlier ones.",
+    ),
+}
diff --git a/tools/release/BUILD.bazel b/tools/release/BUILD.bazel
index 04733b74..343a1ec9 100644
--- a/tools/release/BUILD.bazel
+++ b/tools/release/BUILD.bazel
@@ -10,8 +10,8 @@ bzl_library(
     deps = [
         "//bazeldnf:platforms",
         "//tools:version",
-        "@aspect_bazel_lib//lib:copy_file",
-        "@aspect_bazel_lib//lib:transitions",
-        "@aspect_bazel_lib//lib:write_source_files",
+        "@bazel_lib//lib:copy_file",
+        "@bazel_lib//lib:transitions",
+        "@bazel_lib//lib:write_source_files",
     ],
 )
diff --git a/tools/release/defs.bzl b/tools/release/defs.bzl
index d2e8e305..97fcd6f0 100644
--- a/tools/release/defs.bzl
+++ b/tools/release/defs.bzl
@@ -1,9 +1,9 @@
 "Make releases for platforms supported by bazeldnf"
 
-load("@aspect_bazel_lib//lib:copy_file.bzl", "copy_file")
-load("@aspect_bazel_lib//lib:transitions.bzl", "platform_transition_filegroup")
-load("@aspect_bazel_lib//lib:write_source_files.bzl", "write_source_files")
-load("@aspect_bazel_lib//tools/release:hashes.bzl", "hashes")
+load("@bazel_lib//lib:copy_file.bzl", "copy_file")
+load("@bazel_lib//lib:transitions.bzl", "platform_transition_filegroup")
+load("@bazel_lib//lib:write_source_files.bzl", "write_source_files")
+load("@bazel_lib//tools/release:hashes.bzl", "hashes")
 load("//bazeldnf:platforms.bzl", "PLATFORMS")
 load("//tools:version.bzl", "VERSION")