diff --git a/.bazelrc b/.bazelrc
index 32fc56a..a137b59 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 build --noenable_bzlmod
+build --enable_workspace
 
 # The `-std=c++17` option is required to compile the Riegeli library and
 # `-D_GLIBCXX_USE_CXX11_ABI=0` option is for compatibility with the shared
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7a51044..6953a2f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,6 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       TEST_TMPDIR: '/tmp'
+      USE_BAZEL_VERSION: 8.2.1
     strategy:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
@@ -43,19 +44,30 @@ jobs:
 
       - name: Install dependencies
         run: |
+          set -x
           pip install --upgrade pip setuptools wheel
 
           # Build and install Riegeli from source
           git clone --depth=1 https://github.com/google/riegeli.git /tmp/riegeli
           cd /tmp/riegeli
+          # Downgrade protobuf in MODULE.bazel to avoid python runtime incompatibility with TFDS (which needs <7)
+          sed -i 's|version = "34.1"|version = "28.3"|' MODULE.bazel
           if [ -f configure ]; then ./configure; fi
+          # Disable TensorFlow support in Riegeli python build to avoid local_config_tf errors
+          rm -rf python/riegeli/tensorflow
+          sed -i '/riegeli_dataset_ops/d' python/BUILD
+          sed -i 's|cd bazel-bin/python/build_pip_package.runfiles/com_google_riegeli/python|if [ -d bazel-bin/python/build_pip_package.runfiles/_main/python ]; then cd bazel-bin/python/build_pip_package.runfiles/_main/python; else cd bazel-bin/python/build_pip_package.runfiles/com_google_riegeli/python; fi|' python/build_pip_package.sh
+          grep "_main" python/build_pip_package.sh || { echo "Patch failed!"; exit 1; }
           bazel build -c opt --@rules_python//python/config_settings:python_version=${{ matrix.python-version }} python:build_pip_package
-          ./bazel-bin/python/build_pip_package --dest /tmp/riegeli_dist --bdist
+          ./bazel-bin/python/build_pip_package --dest /tmp/riegeli_dist --bdist || { ls -R bazel-bin/python/build_pip_package.runfiles; exit 1; }
           pip install /tmp/riegeli_dist/*.whl
 
           # Go back to project root and install envlogger
           cd $GITHUB_WORKSPACE
           pip install .[tfds]
+          pip list
+          pip install "protobuf<7"
+          pip list
 
       - name: Run tests
         run: |
diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index 422cc4a..f9078c4 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -219,6 +219,8 @@ http_archive(
     sha256 = "b72c5b44135b90d1ffaba51e08240be0b91707ac60bea08bb4d84b47316211bb",
     strip_prefix = "pybind11_bazel-b162c7c88a253e3f6b673df0c621aca27596ce6b",
     urls = ["https://github.com/pybind/pybind11_bazel/archive/b162c7c88a253e3f6b673df0c621aca27596ce6b.zip"],
+    patches = ["//patches:pybind11_bazel.diff"],
+    patch_args = ["-p1"],
 )
 
 http_archive(
diff --git a/patches/pybind11_bazel.diff b/patches/pybind11_bazel.diff
new file mode 100644
index 0000000..d778ccc
--- /dev/null
+++ b/patches/pybind11_bazel.diff
@@ -0,0 +1,26 @@
+diff -urN a/py/BUILD.tpl b/py/BUILD.tpl
+--- a/py/BUILD.tpl
++++ b/py/BUILD.tpl
+@@ -4,13 +4,7 @@
+ 
+ # Point both runtimes to the same python binary to ensure we always
+ # use the python binary specified by ./configure.py script.
+-load("@bazel_tools//tools/python:toolchain.bzl", "py_runtime_pair")
+-
+-py_runtime(
+-    name = "py2_runtime",
+-    interpreter_path = "%{PYTHON_BIN_PATH}",
+-    python_version = "PY2",
+-)
++load("@rules_python//python:defs.bzl", "py_runtime_pair")
+ 
+ py_runtime(
+     name = "py3_runtime",
+@@ -20,7 +14,6 @@
+ 
+ py_runtime_pair(
+     name = "py_runtime_pair",
+-    py2_runtime = ":py2_runtime",
+     py3_runtime = ":py3_runtime",
+ )
+ 
diff --git a/setup.py b/setup.py
index 1c1c830..d7d7a6f 100644
--- a/setup.py
+++ b/setup.py
@@ -19,6 +19,7 @@
 import os
 import posixpath
 import shutil
+import sys
 
 import setuptools
 from setuptools.command import build_ext
@@ -101,6 +102,7 @@ def run(self):
     build_ext.build_ext.run(self)
 
   def bazel_build(self):
+    os.environ['PYTHON_BIN_PATH'] = sys.executable
 
     if not os.path.exists(self.build_temp):
       os.makedirs(self.build_temp)
@@ -119,6 +121,7 @@ def bazel_build(self):
             '--symlink_prefix=' + os.path.join(self.build_temp, 'bazel-'),
             '--compilation_mode=' + ('dbg' if self.debug else 'opt'),
             '--verbose_failures',
+            '--repo_env=PYTHON_BIN_PATH=' + sys.executable,
         ]
     )