diff --git a/MODULE.bazel b/MODULE.bazel
index 38c7546..f371619 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -14,6 +14,7 @@ bazel_dep(name = "googletest", version = "1.15.2")
 bazel_dep(name = "jsonnet_go", version = "0.20.0")
 bazel_dep(name = "opentelemetry-proto", version = "1.5.0")
 bazel_dep(name = "platforms", version = "0.0.11")
+bazel_dep(name = "toolchains_protoc", version = "0.4.2")  # must come BEFORE protobuf so the toolchain registration wins
 bazel_dep(name = "protobuf", version = "29.3")
 bazel_dep(name = "remote_config_cc")
 bazel_dep(name = "remote_config_sh")
@@ -29,7 +30,11 @@ bazel_dep(name = "rules_shell", version = "0.3.0")
 # but held back to be compatible with bb-remote-execution.
 bazel_dep(name = "rules_proto", version = "7.1.0")
 bazel_dep(name = "toolchains_llvm", version = "1.3.0")
-bazel_dep(name = "toolchains_protoc", version = "0.3.4")
+
+# Mirror the protoc setup from bb-storage: https://github.com/buildbarn/bb-storage/pull/248
+# NB: Match protobuf above, until it ships a pre-built binary toolchain itself
+protoc = use_extension("@toolchains_protoc//protoc:extensions.bzl", "protoc")
+protoc.toolchain(version = "v29.3")
 
 # # Workarounds 2024-06-27
 # ERROR: in tag at https://bcr.bazel.build/modules/grpc-java/1.62.2/MODULE.bazel:89:15: no repository visible as '@com_google_protobuf_javalite' to the repository '@@grpc-java~', but referenced by label '@com_google_protobuf_javalite//:protobuf_javalite' in attribute 'target' of tag 'override'. Is the module 'grpc-java' missing a bazel_dep or use_repo(..., "com_google_protobuf_javalite")?
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 7466da7..8b66ca7 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -267,8 +267,8 @@
     "https://bcr.bazel.build/modules/toolchains_llvm/1.1.2/MODULE.bazel": "402101d6f73115ec49a3a765a3361c1dd90ba3959fa688ccdcd465c36dbbbc52",
     "https://bcr.bazel.build/modules/toolchains_llvm/1.3.0/MODULE.bazel": "6e02731e51f7eb2ec4b01c5e79e722bf738a631f6e03d9b4917cbf2cb027bee1",
     "https://bcr.bazel.build/modules/toolchains_llvm/1.3.0/source.json": "4ce0373a89c6df34dd37cd67285bb871d8e225d30dcb67dd093e077a04bbbb71",
-    "https://bcr.bazel.build/modules/toolchains_protoc/0.3.4/MODULE.bazel": "ae8ab3602d4eaf179fa6a1dbdd83ca8748d43d303a85ec233faab68413c1a287",
-    "https://bcr.bazel.build/modules/toolchains_protoc/0.3.4/source.json": "ca799b9e90e4483a559ed86e9cdad86f27ef60de58fa92ba50803e590f32ae74",
+    "https://bcr.bazel.build/modules/toolchains_protoc/0.4.2/MODULE.bazel": "05a00ffcc77a1bb9bec936621a29865953e8a2fe06f9476bd050b10e9ea84ca3",
+    "https://bcr.bazel.build/modules/toolchains_protoc/0.4.2/source.json": "ddbdfcdc65c4b1e2533d3b8ca0b4b8975b921147d7501e9b556e3d3689f6e427",
     "https://bcr.bazel.build/modules/upb/0.0.0-20211020-160625a/MODULE.bazel": "6cced416be2dc5b9c05efd5b997049ba795e5e4e6fafbe1624f4587767638928",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
     "https://bcr.bazel.build/modules/upb/0.0.0-20230516-61a97ef/MODULE.bazel": "c0df5e35ad55e264160417fd0875932ee3c9dda63d9fccace35ac62f45e1b6f9",