diff --git a/MODULE.bazel b/MODULE.bazel
index e8f1e3c57..2cf09888a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -11,6 +11,7 @@ bazel_dep(name = "protobuf", version = "3.19.6", repo_name = "com_google_protobu
 bazel_dep(name = "rules_go", version = "0.50.1", repo_name = "io_bazel_rules_go")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_proto", version = "4.0.0")
+bazel_dep(name = "rules_shell", version = "0.2.0")
 
 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
 
diff --git a/def.bzl b/def.bzl
index e5fa09787..86b3f5ceb 100644
--- a/def.bzl
+++ b/def.bzl
@@ -20,6 +20,12 @@ load(
     "@bazel_skylib//lib:shell.bzl",
     "shell",
 )
+load("@rules_shell//shell:sh_binary.bzl",
+    "sh_binary"
+)
+load("@rules_shell//shell:sh_test.bzl",
+    "sh_test"
+)
 load(
     "//internal:gazelle_binary.bzl",
     _gazelle_binary = "gazelle_binary_wrapper",
@@ -218,7 +224,7 @@ def gazelle(name, **kwargs):
     tags_set = {t: "" for t in kwargs.pop("tags", [])}
     tags_set["manual"] = ""
     tags = tags_set.keys()
-    native.sh_binary(
+    sh_binary(
         name = name,
         tags = tags,
         srcs = [runner_name],
@@ -242,7 +248,7 @@ def gazelle_test(name, size = None, timeout = None, **kwargs):
     tags_set["no-cache"] = ""
     tags_set["external"] = ""
     tags = tags_set.keys()
-    native.sh_test(
+    sh_test(
         name = name,
         srcs = [runner_name],
         visibility = visibility,
diff --git a/deps.bzl b/deps.bzl
index f2ba4db78..56c0bf998 100644
--- a/deps.bzl
+++ b/deps.bzl
@@ -64,6 +64,19 @@ def gazelle_dependencies(
         sha256 = "26d4021f6898e23b82ef953078389dd49ac2b5618ac564ade4ef87cced147b38",
     )
 
+    # We are not able to call rules_shell's dependency macros without introducing new levels of
+    # such macros to gazelle. With Bazel < 8, rules_shell forwards to the native sh_* rules, so
+    # its dependencies are not needed. With Bazel 8, rules_shell is automatically loaded by Bazel.
+    _maybe(
+        http_archive,
+        name = "rules_shell",
+        urls = [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_shell/releases/download/v0.3.0/rules_shell-v0.3.0.tar.gz",
+            "https://github.com/bazelbuild/rules_shell/releases/download/v0.3.0/rules_shell-v0.3.0.tar.gz",
+        ],
+        sha256 = "d8cd4a3a91fc1dc68d4c7d6b655f09def109f7186437e3f50a9b60ab436a0c53",
+        strip_prefix = "rules_shell-0.3.0",
+    )
     if go_sdk:
         go_repository_cache(
             name = "bazel_gazelle_go_repository_cache",
diff --git a/docs/BUILD.bazel b/docs/BUILD.bazel
index 6ce4ede3f..39cc1089b 100644
--- a/docs/BUILD.bazel
+++ b/docs/BUILD.bazel
@@ -8,6 +8,7 @@ the stardoc repository, which is not a dependency users should install.
 load("@bazel_skylib//rules:diff_test.bzl", "diff_test")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@io_bazel_stardoc//stardoc:stardoc.bzl", "stardoc")
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 
 # gazelle:ignore
 _DOC_SRCS = {
diff --git a/tests/bzl_deps/BUILD.bazel b/tests/bzl_deps/BUILD.bazel
index 86679e6b9..d045f79a6 100644
--- a/tests/bzl_deps/BUILD.bazel
+++ b/tests/bzl_deps/BUILD.bazel
@@ -3,5 +3,8 @@ load(":bzl_test.bzl", "bzl_test")
 bzl_test(
     name = "def_bzl_test",
     src = "do_nothing_macro.bzl",
-    deps = ["//:def"],
+    deps = [
+      "//:def",
+      "@rules_shell//shell:rules_bzl",
+    ],
 )
diff --git a/tests/cli/BUILD.bazel b/tests/cli/BUILD.bazel
index df64d6360..154500b39 100644
--- a/tests/cli/BUILD.bazel
+++ b/tests/cli/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 load(":env_variables_test.bzl", "env_variables_test_suite")
 
 env_variables_test_suite()
diff --git a/tests/visibility_attr/BUILD.bazel b/tests/visibility_attr/BUILD.bazel
index e404f97d2..c3b2aa4bf 100644
--- a/tests/visibility_attr/BUILD.bazel
+++ b/tests/visibility_attr/BUILD.bazel
@@ -1,3 +1,4 @@
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 load("//:def.bzl", "gazelle")
 
 gazelle(
diff --git a/tests/visibility_attr/child/BUILD.bazel b/tests/visibility_attr/child/BUILD.bazel
index 5f2e9dc0a..f6b5691f6 100644
--- a/tests/visibility_attr/child/BUILD.bazel
+++ b/tests/visibility_attr/child/BUILD.bazel
@@ -1,4 +1,5 @@
 load("@bazel_skylib//rules:build_test.bzl", "build_test")
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
 
 build_test(
     name = "visibility_test",
diff --git a/vendor/github.com/bazelbuild/buildtools/build/build_defs.bzl b/vendor/github.com/bazelbuild/buildtools/build/build_defs.bzl
index 04462607e..f7842dddd 100644
--- a/vendor/github.com/bazelbuild/buildtools/build/build_defs.bzl
+++ b/vendor/github.com/bazelbuild/buildtools/build/build_defs.bzl
@@ -19,6 +19,12 @@ load(
     "@io_bazel_rules_go//go:def.bzl",
     "GoSource",
 )
+load("@rules_shell//shell:sh_binary.bzl",
+    "sh_binary"
+)
+load("@rules_shell//shell:sh_test.bzl",
+    "sh_test"
+)
 
 _GO_YACC_TOOL = "@org_golang_x_tools//cmd/goyacc"
 
@@ -130,7 +136,7 @@ diff -q "$$F1" "$$F2"
 eof
 """,
     )
-    native.sh_test(
+    sh_test(
         name = src + "_checkshtest",
         size = "small",
         srcs = [src + "_check.sh"],
@@ -147,7 +153,7 @@ eof
         cmd = "echo 'cp $${BUILD_WORKSPACE_DIRECTORY}/$(location " + gen +
               ") $${BUILD_WORKSPACE_DIRECTORY}/" + native.package_name() + "/" + src + "' > $@",
     )
-    native.sh_binary(
+    sh_binary(
         name = src + "_copy",
         srcs = [src + "_copysh"],
         data = [gen],