--- WORKSPACE.orig	2026-06-18 18:08:19 UTC
+++ WORKSPACE
@@ -2,31 +2,7 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-# Hedron's Compile Commands Extractor for Bazel
-# https://github.com/hedronvision/bazel-compile-commands-extractor
-http_archive(
-    name = "hedron_compile_commands",
-    sha256 = "e875b18876190b172ab59eaf193c2eec16fff8c46306c5eb0577ef7d1f8a65f7",
-    strip_prefix = "bazel-compile-commands-extractor-9f69112e3f61b9df76a8275085dabad36ef37c96",
-    url = "https://github.com/kralicky/bazel-compile-commands-extractor/archive/9f69112e3f61b9df76a8275085dabad36ef37c96.tar.gz",
-)
 
-load("@hedron_compile_commands//:workspace_setup.bzl", "hedron_compile_commands_setup")
-
-hedron_compile_commands_setup()
-
-load("@hedron_compile_commands//:workspace_setup_transitive.bzl", "hedron_compile_commands_setup_transitive")
-
-hedron_compile_commands_setup_transitive()
-
-load("@hedron_compile_commands//:workspace_setup_transitive_transitive.bzl", "hedron_compile_commands_setup_transitive_transitive")
-
-hedron_compile_commands_setup_transitive_transitive()
-
-load("@hedron_compile_commands//:workspace_setup_transitive_transitive_transitive.bzl", "hedron_compile_commands_setup_transitive_transitive_transitive")
-
-hedron_compile_commands_setup_transitive_transitive_transitive()
-
 envoy_version = "f387231af8dd7274e37c5ae2cc797cb09a948818"
 
 openssh_version = "V_10_3_P1"
@@ -35,8 +11,6 @@ readerwriterqueue_version = "1.0.7"
 
 readerwriterqueue_version = "1.0.7"
 
-rules_oci_version = "2.3.1"
-
 local_repository(
     name = "envoy_build_config",
     path = "bazel/envoy_build_config",
@@ -106,6 +80,8 @@ external_http_archive(
         "@envoy_toolshed//:patches/toolchains_llvm.patch",
         # linux->darwin cross-compile support
         "//patches/toolchains_llvm:0002-darwin.patch",
+        # FreeBSD OS support in toolchains_llvm
+        "//patches/toolchains_llvm:freebsd.patch",
     ],
 )
 
@@ -116,6 +92,8 @@ external_http_archive(
     patches = [
         "//patches/luajit:0001-libunwind-fde-offset.patch",
         "//patches/luajit:fix-luajit-asan.patch",
+        "//patches/luajit:freebsd.patch",
+        "//patches/luajit:getentropy_freebsd.patch",
     ],
 )
 
@@ -125,21 +103,6 @@ patch_antlr4_runtimes()
 
 patch_antlr4_runtimes()
 
-http_archive(
-    name = "rules_oci",
-    sha256 = "6d47e0bb9d3c269695cbb35abb603d1db08434376a1210867da8f6f4a9c630ba",
-    strip_prefix = "rules_oci-" + rules_oci_version,
-    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v" + rules_oci_version + "/rules_oci-v" + rules_oci_version + ".tar.gz",
-)
-
-load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
-
-rules_oci_dependencies()
-
-load("@rules_oci//oci:repositories.bzl", "oci_register_toolchains")
-
-oci_register_toolchains(name = "oci")
-
 load("@envoy//bazel:bazel_deps.bzl", "envoy_bazel_dependencies")
 
 envoy_bazel_dependencies()
@@ -152,33 +115,39 @@ envoy_python_dependencies()
 
 envoy_python_dependencies()
 
+# FreeBSD: Pre-register rules_proto 7.1.0 before envoy_dependency_imports() runs.
+# rules_proto_grpc_toolchains() (called inside envoy_dependency_imports) would otherwise
+# register rules_proto 5.3.0-21.7 first; external_http_archive then skips the 7.1.0
+# registration from api/bazel/repositories.bzl because existing_rules() already contains
+# "rules_proto".  rules_proto 5.3.0-21.7 lacks proto/proto_common.bzl which is required
+# by io_bazel_rules_go/proto/compiler.bzl at BUILD loading time.
+http_archive(
+    name = "rules_proto",
+    sha256 = "14a225870ab4e91869652cfd69ef2028277fc1dc4910d65d353b62d6e0ae21f4",
+    strip_prefix = "rules_proto-7.1.0",
+    url = "https://github.com/bazelbuild/rules_proto/archive/refs/tags/7.1.0.tar.gz",
+)
+
 load("@envoy//bazel:dependency_imports.bzl", "envoy_dependency_imports")
 
 envoy_dependency_imports()
 
-load("@envoy//bazel:repo.bzl", "envoy_repo")
+# FreeBSD: Register @local_jdk compile toolchains before DEFAULT.WORKSPACE.SUFFIX
+# adds the remote JDK toolchains. The @local_jdk toolchains have
+# exec_compatible_with = HOST_CONSTRAINTS (FreeBSD) and use local_jdk as runtime
+# (not remotejdk_21), avoiding toolchain resolution failures on FreeBSD.
+# The @local_jdk repo is set up by jdk.WORKSPACE in DEFAULT.WORKSPACE.SUFFIX;
+# register_toolchains here is lazy and resolves during build analysis.
+register_toolchains("@local_jdk//:all")
 
-envoy_repo()
+# FreeBSD: Register the system C++ compiler toolchain.  The pomerium-envoy-custom
+# WORKSPACE normally downloads a custom LLVM toolchain and registers it via
+# llvm_register_toolchains(); on FreeBSD we use the base system Clang instead.
+register_toolchains("@local_config_cc//:all")
 
-load("//bazel:toolchains.bzl", "pomerium_envoy_toolchains")
+load("@envoy//bazel:repo.bzl", "envoy_repo")
 
-pomerium_envoy_toolchains()
-
-load("//bazel/sysroots:load_sysroots.bzl", "load_sysroots")
-
-load_sysroots()
-
-load("//bazel/cxx_libs:load_cxx_cross_libs.bzl", "load_cxx_cross_libs")
-
-load_cxx_cross_libs()
-
-load("//bazel/llvm_extras:load_llvm_extras.bzl", "load_llvm_extras")
-
-load_llvm_extras()
-
-load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")
-
-llvm_register_toolchains()
+envoy_repo()
 
 envoy_http_archive(
     name = "openssh_portable",