diff --git a/MODULE.bazel b/MODULE.bazel
index 8556f157..cdad157a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -10,6 +10,7 @@ bazel_dep(name = "platforms", version = "0.0.11")
 bazel_dep(name = "rules_oci", version = "2.2.6")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "rules_go", version = "0.54.0")
+bazel_dep(name = "rules_shell", version = "0.8.0")
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(version = "1.23.9")
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 91c3e274..af5ea25a 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -150,7 +150,8 @@
     "https://bcr.bazel.build/modules/rules_python/0.40.0/source.json": "939d4bd2e3110f27bfb360292986bb79fd8dcefb874358ccd6cdaa7bda029320",
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
-    "https://bcr.bazel.build/modules/rules_shell/0.3.0/source.json": "c55ed591aa5009401ddf80ded9762ac32c358d2517ee7820be981e2de9756cf3",
+    "https://bcr.bazel.build/modules/rules_shell/0.8.0/MODULE.bazel": "f6a89f1d6a669a26f28fe814503857055d76306b79cfc11d12399af08d0b80ae",
+    "https://bcr.bazel.build/modules/rules_shell/0.8.0/source.json": "eb53cc815bc503c6683c5fe12d943f98883f81fc22f51403ec8a95610cba4195",
     "https://bcr.bazel.build/modules/stardoc/0.5.1/MODULE.bazel": "1a05d92974d0c122f5ccf09291442580317cdd859f07a8655f1db9a60374f9f8",
     "https://bcr.bazel.build/modules/stardoc/0.5.3/MODULE.bazel": "c7f6948dae6999bf0db32c1858ae345f112cacf98f174c7a8bb707e41b974f1c",
     "https://bcr.bazel.build/modules/stardoc/0.5.4/MODULE.bazel": "6569966df04610b8520957cb8e97cf2e9faac2c0309657c537ab51c16c18a2a4",
@@ -172,7 +173,7 @@
   "moduleExtensions": {
     "//gitops:extensions.bzl%toolchains": {
       "general": {
-        "bzlTransitiveDigest": "7KoML+gmGc0zw78Cvm/P9ybt0yMKHvqdlM+SHqm6cn4=",
+        "bzlTransitiveDigest": "FtzhjKwjQjIWTfxqYcXDdbIIbxfqwM9SHqZRgjiuKUo=",
         "usagesDigest": "Pz/CYwzg5QDhe8o5CQaVvr3yLpd4nUDgrWlPS1flUU8=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
diff --git a/mirror/tests/BUILD.bazel b/mirror/tests/BUILD.bazel
index 6991bf6d..71429027 100644
--- a/mirror/tests/BUILD.bazel
+++ b/mirror/tests/BUILD.bazel
@@ -3,6 +3,7 @@ load("@aspect_bazel_lib//lib:write_source_files.bzl", "write_source_files")
 load("@rules_gitops//gitops:defs.bzl", "k8s_deploy", "k8s_test_setup")
 load("@rules_gitops//skylib/kustomize:kustomize.bzl", "kustomize")
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load("//mirror:defs.bzl", "mirror_image")
 
 # create a simple image for testing
diff --git a/skylib/kustomize/BUILD.bazel b/skylib/kustomize/BUILD.bazel
index 142995fe..32d11c03 100644
--- a/skylib/kustomize/BUILD.bazel
+++ b/skylib/kustomize/BUILD.bazel
@@ -8,6 +8,8 @@
 # OF ANY KIND, either express or implied. See the License for the specific language
 # governing permissions and limitations under the License.
 
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
+
 exports_files([
     "run-all.sh.tpl",
     "kubectl.sh.tpl",
diff --git a/skylib/kustomize/kustomize.bzl b/skylib/kustomize/kustomize.bzl
index 8a82ec7a..abbb16d9 100644
--- a/skylib/kustomize/kustomize.bzl
+++ b/skylib/kustomize/kustomize.bzl
@@ -26,6 +26,7 @@ def _download_kustomize_impl(ctx):
         fail("Platform " + ctx.os.name + " is not supported")
 
     ctx.file("BUILD", """
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 sh_binary(
     name = "kustomize",
     srcs = ["bin/kustomize"],
diff --git a/skylib/kustomize/tests/BUILD.bazel b/skylib/kustomize/tests/BUILD.bazel
index a468485d..59a763a9 100644
--- a/skylib/kustomize/tests/BUILD.bazel
+++ b/skylib/kustomize/tests/BUILD.bazel
@@ -12,6 +12,7 @@ load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@aspect_bazel_lib//lib:write_source_files.bzl", "write_source_files")
 load("@bazel_tools//tools/build_rules:test_rules.bzl", "file_test")
 load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load("//push_oci:push_oci.bzl", "push_oci_rule")
 load("//skylib:push_alias.bzl", "pushed_image_alias")
 load("//skylib/kustomize:kustomize.bzl", "gitops", "kubectl", "kustomize", "push_all")
diff --git a/skylib/tests/BUILD.bazel b/skylib/tests/BUILD.bazel
index d9675622..959b2488 100644
--- a/skylib/tests/BUILD.bazel
+++ b/skylib/tests/BUILD.bazel
@@ -8,6 +8,7 @@
 # OF ANY KIND, either express or implied. See the License for the specific language
 # governing permissions and limitations under the License.
 
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load("//skylib:k8s.bzl", "k8s_deploy")
 
 k8s_deploy(
diff --git a/transitions/tests/BUILD.bazel b/transitions/tests/BUILD.bazel
index 31ddca71..52edfb22 100644
--- a/transitions/tests/BUILD.bazel
+++ b/transitions/tests/BUILD.bazel
@@ -1,6 +1,7 @@
 load("@aspect_bazel_lib//lib:diff_test.bzl", "diff_test")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load("//transitions:transitions.bzl", "platform_transition_binary", "platform_transition_filegroup")
 
 platform(