diff --git a/MODULE.bazel b/MODULE.bazel
index 3799f4d43535e..2a82334966c16 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -10,14 +10,14 @@ bazel_dep(name = "bazel_features", version = "1.50.0")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1.2")
 bazel_dep(name = "contrib_rules_jvm", version = "0.33.0")
-bazel_dep(name = "llvm", version = "0.8.11")
+bazel_dep(name = "llvm", version = "0.8.18")
 bazel_dep(name = "package_metadata", version = "0.0.10")
 bazel_dep(name = "platforms", version = "1.1.0")
 
 # If you update this, also update the prebuilt version of `protoc` we use below
 bazel_dep(name = "protobuf", version = "33.5")
 
-bazel_dep(name = "rules_cc", version = "0.2.20", dev_dependency = True)
+bazel_dep(name = "rules_cc", version = "0.2.22", dev_dependency = True)
 
 # rules_rs pulls protobuf for optional prost support. Keep Selenium on the
 # explicitly pinned protobuf version above so it stays paired with prebuilt protoc.
@@ -39,16 +39,7 @@ bazel_dep(name = "rules_pkg", version = "1.2.0")
 bazel_dep(name = "rules_python", version = "1.9.0")
 bazel_dep(name = "rules_proto", version = "7.1.0")
 bazel_dep(name = "rules_ruby", version = "0.28.0")
-bazel_dep(name = "rules_rs", version = "0.0.96")
-
-# Remove patch when updating to rules_rs >= 0.0.108
-single_version_override(
-    module_name = "rules_rs",
-    patch_strip = 1,
-    patches = [
-        "//third_party/bazel:rules_rs_zlib_snapshot.patch",
-    ],
-)
+bazel_dep(name = "rules_rs", version = "0.0.108")
 
 single_version_override(
     module_name = "rules_jvm_external",
@@ -392,6 +383,13 @@ use_repo(ruby, "bundle", "ruby", "ruby_toolchains")
 register_toolchains("@ruby_toolchains//:all")
 
 rules_rust = use_extension("@rules_rs//rs:rules_rust.bzl", "rules_rust")
+
+# Carries hermeticbuild/rules_rust#54: gcc <= 12 doesn't pass `-ffile-prefix-map`
+# to the assembler, so ring and zstd-sys `.S` debug info trips the hermeticity check.
+rules_rust.patch(
+    patches = ["//third_party/bazel:rules_rust_debug_prefix_map.patch"],
+    strip = 1,
+)
 use_repo(rules_rust, "rules_rust")
 
 rust_toolchains = use_extension("@rules_rs//rs/toolchains:module_extension.bzl", "toolchains")
@@ -402,7 +400,7 @@ rust_toolchains.toolchain(
 )
 use_repo(rust_toolchains, "default_rust_toolchains")
 
-register_toolchains("@default_rust_toolchains//:all")
+register_toolchains("@default_rust_toolchains//...")
 
 # TODO: Register only Windows exec for now, full @llvm migration can be done as followup.
 llvm_toolchains = use_extension("@llvm//extensions:toolchain.bzl", "toolchain")
diff --git a/third_party/bazel/rules_rs_zlib_snapshot.patch b/third_party/bazel/rules_rs_zlib_snapshot.patch
deleted file mode 100644
index 6bd1b45a4ca58..0000000000000
--- a/third_party/bazel/rules_rs_zlib_snapshot.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/rs/private/rustc_repository.bzl b/rs/private/rustc_repository.bzl
---- a/rs/private/rustc_repository.bzl
-+++ b/rs/private/rustc_repository.bzl
-@@ -10,12 +10,12 @@ load(":rust_repository_utils.bzl", "RUST_REPOSITORY_COMMON_ATTR", "download_and_e
- _LINUX_ZLIB = {
-     "aarch64": struct(
-         libdir = "usr/lib/aarch64-linux-gnu",
-         sha256 = "cbe3d39ec32d3cc27c021ae4af11e7c67bdf9d700d573207e0941d4038056278",
--        url = "https://ports.ubuntu.com/ubuntu-ports/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_arm64.deb",
-+        url = "https://snapshot.ubuntu.com/ubuntu/20260801T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_arm64.deb",
-     ),
-     "x86_64": struct(
-         libdir = "usr/lib/x86_64-linux-gnu",
-         sha256 = "7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20",
--        url = "https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb",
-+        url = "https://snapshot.ubuntu.com/ubuntu/20260801T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb",
-     ),
- }
diff --git a/third_party/bazel/rules_rust_debug_prefix_map.patch b/third_party/bazel/rules_rust_debug_prefix_map.patch
new file mode 100644
index 0000000000000..4489f3aea6d60
--- /dev/null
+++ b/third_party/bazel/rules_rust_debug_prefix_map.patch
@@ -0,0 +1,17 @@
+diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_script.bzl
+--- a/cargo/private/cargo_build_script.bzl
++++ b/cargo/private/cargo_build_script.bzl
+@@ -586,8 +586,11 @@ def _cargo_build_script_impl(ctx):
+         # to determine the deployment target when building for apple platforms (`macosx-version-min`
+         # for example, itself derived from the `macos_minimum_os` Bazel argument).
+         if toolchain.target_abi != "msvc":
+-            cc_c_args = cc_c_args + ["-ffile-prefix-map=${pwd}=."]
+-            cc_cxx_args = cc_cxx_args + ["-ffile-prefix-map=${pwd}=."]
++            # gcc forwards only the `-fdebug-prefix-map` spelling to a separate
++            # `as`, so without it `.S` sources keep an absolute `DW_AT_comp_dir`.
++            prefix_map_args = ["-ffile-prefix-map=${pwd}=.", "-fdebug-prefix-map=${pwd}=."]
++            cc_c_args = cc_c_args + prefix_map_args
++            cc_cxx_args = cc_cxx_args + prefix_map_args
+         env["CFLAGS"] = " ".join(_pwd_flags(cc_c_args))
+         env["CXXFLAGS"] = " ".join(_pwd_flags(cc_cxx_args))
+         # It may be tempting to forward ARFLAGS, but cc-rs is opinionated enough