diff --git a/WORKSPACE b/WORKSPACE
index acd4711..ee5ac1b 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -107,16 +107,6 @@
 
 py_repositories()
 
-http_archive(
-    name = "com_google_protobuf",
-    integrity = "sha256-zl0At4RQoMpAC/NgrADA1ZnMIl8EnZhqJ+mk45bFqEo=",
-    strip_prefix = "protobuf-29.0-rc2",
-    urls = [
-        "https://github.com/protocolbuffers/protobuf/archive/v29.0-rc2.tar.gz",
-        "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v29.0-rc2.tar.gz",
-    ],
-)
-
 load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 
 protobuf_deps()
diff --git a/go/private/repositories.bzl b/go/private/repositories.bzl
index e25885a..db14349 100644
--- a/go/private/repositories.bzl
+++ b/go/private/repositories.bzl
@@ -165,7 +165,8 @@
     # reasons for this:
     #
     # * com_google_protobuf has its own dependency macro. We can't load
-    #   the macro here.
+    #   the macro here, but we still instantiate the repo itself because
+    #   rules_cc depends on it being present through rules_java.
     # * rules_proto also has a dependency macro. It's only needed by tests and
     #   by gogo_special_proto. Users will need to declare it anyway.
     # * org_golang_google_grpc has too many dependencies for us to maintain.
@@ -340,6 +341,17 @@
         urls = ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.17/rules_cc-0.0.17.tar.gz"],
     )
 
+    wrapper(
+        http_archive,
+        name = "com_google_protobuf",
+        integrity = "sha256-zl0At4RQoMpAC/NgrADA1ZnMIl8EnZhqJ+mk45bFqEo=",
+        strip_prefix = "protobuf-29.0-rc2",
+        urls = [
+            "https://github.com/protocolbuffers/protobuf/archive/v29.0-rc2.tar.gz",
+            "https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v29.0-rc2.tar.gz",
+        ],
+    )
+
 def _go_host_compatible_sdk_label_impl(ctx):
     ctx.file("BUILD.bazel")
     ctx.file("defs.bzl", """HOST_COMPATIBLE_SDK = Label("@go_sdk//:ROOT")""")