diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 28ff7fd..8649797 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -21,7 +21,7 @@
 .minimum_supported_version: &minimum_supported_version
   # For testing minimum supported version.
   # NOTE: Keep in sync with //:version.bzl
-  bazel: 6.2.0
+  bazel: 6.4.0
   skip_in_bazel_downstream_pipeline: "Bazel 6 required"
 .reusable_config: &reusable_config
   build_targets:
@@ -32,6 +32,7 @@
     - "@rules_python//examples/wheel/..."
   build_flags:
     - "--keep_going"
+    - "--build_tag_filters=-integration-test"
   test_targets:
     - "--"
     - "..."
@@ -42,6 +43,18 @@
     - "--noenable_bzlmod"
   build_flags:
     - "--noenable_bzlmod"
+.common_bazelinbazel_config: &common_bazelinbazel_config
+    build_flags:
+      - "--build_tag_filters=integration-test"
+    test_flags:
+      - "--test_tag_filters=integration-test"
+      - "--jobs=2"
+      # The integration tests are so expensive that only a few can be run concurrently
+      # without harming overall reliability and runtime.
+      - "--local_test_jobs=2"
+    build_targets: ["..."]
+    test_targets: ["..."]
+
 .reusable_build_test_all: &reusable_build_test_all
   build_targets: ["..."]
   test_targets: ["..."]
@@ -420,19 +433,14 @@
     working_directory: examples/pip_repository_annotations
     platform: windows
 
-  integration_test_compile_pip_requirements_ubuntu_min_workspace:
-    <<: *minimum_supported_version
-    <<: *reusable_build_test_all
-    <<: *common_workspace_flags
-    name: "compile_pip_requirements: Ubuntu using minimum Bazel"
-    working_directory: tests/integration/compile_pip_requirements
+  integration_test_bazelinbazel_ubuntu:
+    <<: *common_bazelinbazel_config
+    name: "tests/integration bazel-in-bazel: Ubuntu"
     platform: ubuntu2004
-  integration_test_compile_pip_requirements_ubuntu_min_bzlmod:
-    <<: *minimum_supported_version
-    <<: *reusable_build_test_all
-    name: "compile_pip_requirements: Ubuntu using minimum Bazel"
-    working_directory: tests/integration/compile_pip_requirements
-    platform: ubuntu2004
+  integration_test_bazelinbazel_debian:
+    <<: *common_bazelinbazel_config
+    name: "tests/integration bazel-in-bazel: Debian"
+    platform: debian11
 
   integration_test_compile_pip_requirements_ubuntu:
     <<: *reusable_build_test_all
@@ -507,18 +515,6 @@
     - "bazel run //:os_specific_requirements.update"
     - "git diff --exit-code"
 
-  integration_test_pip_repository_entry_points_ubuntu_workspace:
-    <<: *reusable_build_test_all
-    <<: *common_workspace_flags
-    name: "pip_repository_entry_points: Ubuntu, workspace"
-    working_directory: tests/integration/pip_repository_entry_points
-    platform: ubuntu2004
-  integration_test_pip_repository_entry_points_debian_workspace:
-    <<: *reusable_build_test_all
-    <<: *common_workspace_flags
-    name: "pip_repository_entry_points: Debian, workspace"
-    working_directory: tests/integration/pip_repository_entry_points
-    platform: debian11
   integration_test_pip_repository_entry_points_macos_workspace:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
@@ -532,18 +528,6 @@
     working_directory: tests/integration/pip_repository_entry_points
     platform: windows
 
-  integration_test_ignore_root_user_error_ubuntu_workspace:
-    <<: *reusable_build_test_all
-    <<: *common_workspace_flags
-    name: "ignore_root_user_error: Ubuntu, workspace"
-    working_directory: tests/integration/ignore_root_user_error
-    platform: ubuntu2004
-  integration_test_ignore_root_user_error_debian_workspace:
-    <<: *reusable_build_test_all
-    <<: *common_workspace_flags
-    name: "ignore_root_user_error: Debian, workspace"
-    working_directory: tests/integration/ignore_root_user_error
-    platform: debian11
   integration_test_ignore_root_user_error_macos_workspace:
     <<: *reusable_build_test_all
     <<: *common_workspace_flags
@@ -602,4 +586,3 @@
     shell_commands:
     # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
-
diff --git a/.bazelignore b/.bazelignore
index 9104609..9bcb523 100644
--- a/.bazelignore
+++ b/.bazelignore
@@ -10,13 +10,19 @@
 # treated as directories with valid BUILD files for the main repo.
 # Any directory with a WORKSPACE in it should be added here, with
 # an entry like `bazel-{workspacename}`
+examples/bzlmod/bazel-bin
 examples/bzlmod/bazel-bzlmod
+examples/bzlmod/bazel-out
+examples/bzlmod/bazel-testlogs
+examples/bzlmod/other_module/bazel-bin
 examples/bzlmod/other_module/bazel-other_module
+examples/bzlmod/other_module/bazel-out
+examples/bzlmod/other_module/bazel-testlogs
 examples/bzlmod_build_file_generation/bazel-bzlmod_build_file_generation
 examples/multi_python_versions/bazel-multi_python_versions
 examples/pip_parse/bazel-pip_parse
 examples/pip_parse_vendored/bazel-pip_parse_vendored
 examples/py_proto_library/bazel-py_proto_library
-tests/compile_pip_requirements/bazel-compile_pip_requirements
-tests/ignore_root_user_error/bazel-ignore_root_user_error
-tests/pip_repository_entry_points/bazel-pip_repository_entry_points
+tests/integration/compile_pip_requirements/bazel-compile_pip_requirements
+tests/integration/ignore_root_user_error/bazel-ignore_root_user_error
+tests/integration/pip_repository_entry_points/bazel-pip_repository_entry_points
diff --git a/.bazelrc b/.bazelrc
index 8f5a80e..4188090 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -2,7 +2,8 @@
 # Trick bazel into treating BUILD files under examples/* as being regular files
 # This lets us glob() up all the files inside the examples to make them inputs to tests
 # (Note, we cannot use `common --deleted_packages` because the bazel version command doesn't support it)
-# To update these lines, run tools/update_deleted_packages.sh
+# To update these lines, execute
+# `bazel run @rules_bazel_integration_test//tools:update_deleted_packages`
 build --deleted_packages=examples/build_file_generation,examples/build_file_generation/random_number_generator,examples/bzlmod,examples/bzlmod_build_file_generation,examples/bzlmod_build_file_generation/other_module/other_module/pkg,examples/bzlmod_build_file_generation/runfiles,examples/bzlmod/entry_points,examples/bzlmod/entry_points/tests,examples/bzlmod/libs/my_lib,examples/bzlmod/other_module,examples/bzlmod/other_module/other_module/pkg,examples/bzlmod/patches,examples/bzlmod/py_proto_library,examples/bzlmod/py_proto_library/example.com/another_proto,examples/bzlmod/py_proto_library/example.com/proto,examples/bzlmod/runfiles,examples/bzlmod/tests,examples/bzlmod/tests/dupe_requirements,examples/bzlmod/tests/other_module,examples/bzlmod/whl_mods,examples/multi_python_versions/libs/my_lib,examples/multi_python_versions/requirements,examples/multi_python_versions/tests,examples/pip_parse,examples/pip_parse_vendored,examples/pip_repository_annotations,examples/py_proto_library,examples/py_proto_library/example.com/another_proto,examples/py_proto_library/example.com/proto,tests/integration/compile_pip_requirements,tests/integration/compile_pip_requirements_test_from_external_repo,tests/integration/ignore_root_user_error,tests/integration/pip_repository_entry_points
 query --deleted_packages=examples/build_file_generation,examples/build_file_generation/random_number_generator,examples/bzlmod,examples/bzlmod_build_file_generation,examples/bzlmod_build_file_generation/other_module/other_module/pkg,examples/bzlmod_build_file_generation/runfiles,examples/bzlmod/entry_points,examples/bzlmod/entry_points/tests,examples/bzlmod/libs/my_lib,examples/bzlmod/other_module,examples/bzlmod/other_module/other_module/pkg,examples/bzlmod/patches,examples/bzlmod/py_proto_library,examples/bzlmod/py_proto_library/example.com/another_proto,examples/bzlmod/py_proto_library/example.com/proto,examples/bzlmod/runfiles,examples/bzlmod/tests,examples/bzlmod/tests/dupe_requirements,examples/bzlmod/tests/other_module,examples/bzlmod/whl_mods,examples/multi_python_versions/libs/my_lib,examples/multi_python_versions/requirements,examples/multi_python_versions/tests,examples/pip_parse,examples/pip_parse_vendored,examples/pip_repository_annotations,examples/py_proto_library,examples/py_proto_library/example.com/another_proto,examples/py_proto_library/example.com/proto,tests/integration/compile_pip_requirements,tests/integration/compile_pip_requirements_test_from_external_repo,tests/integration/ignore_root_user_error,tests/integration/pip_repository_entry_points
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 52925a2..060cb9c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -20,7 +20,7 @@
     rev: 6.1.0
     hooks:
       - id: buildifier
-        args: &args 
+        args: &args
           # Keep this argument in sync with .bazelci/presubmit.yaml
           - --warnings=all
       - id: buildifier-lint
@@ -30,7 +30,7 @@
     hooks:
       - id: isort
         name: isort (python)
-        args: 
+        args:
           - --profile
           - black
   - repo: https://github.com/psf/black
@@ -42,6 +42,6 @@
       - id: update-deleted-packages
         name: Update deleted packages
         language: script
-        entry: ./tools/update_deleted_packages.sh
-        files: ^((examples|tests)/*/(MODULE.bazel|WORKSPACE|WORKSPACE.bzlmod|BUILD.bazel)|.bazelrc|tools/update_deleted_packages.sh)$
+        entry: bazel run @rules_bazel_integration_test//tools:update_deleted_packages
+        files: ^((examples|tests)/.*/(MODULE.bazel|WORKSPACE|WORKSPACE.bzlmod|BUILD.bazel)|.bazelrc)$
         pass_filenames: false
diff --git a/BUILD.bazel b/BUILD.bazel
index 007e524..cd4cbc5 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -44,9 +44,7 @@
         "@rules_python_gazelle_plugin//:distribution",
     ],
     visibility = [
-        "//examples:__pkg__",
-        "//tests:__pkg__",
-        "//tests/toolchains:__pkg__",
+        "//:__subpackages__",
     ],
 )
 
diff --git a/MODULE.bazel b/MODULE.bazel
index e13d0af..e89b8ef 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -12,8 +12,6 @@
 bazel_dep(name = "rules_proto", version = "5.3.0-21.7")
 bazel_dep(name = "protobuf", version = "21.7", repo_name = "com_google_protobuf")
 
-bazel_dep(name = "stardoc", version = "0.6.2", dev_dependency = True, repo_name = "io_bazel_stardoc")
-
 internal_deps = use_extension("@rules_python//python/private/bzlmod:internal_deps.bzl", "internal_deps")
 internal_deps.install()
 use_repo(
@@ -55,7 +53,10 @@
 # This call registers the Python toolchains.
 register_toolchains("@pythons_hub//:all")
 
-# ===== DEV ONLY SETUP =====
+# ===== DEV ONLY DEPS AND SETUP BELOW HERE =====
+bazel_dep(name = "stardoc", version = "0.6.2", dev_dependency = True, repo_name = "io_bazel_stardoc")
+bazel_dep(name = "rules_bazel_integration_test", version = "0.20.0", dev_dependency = True)
+
 dev_pip = use_extension(
     "//python/extensions:pip.bzl",
     "pip",
@@ -76,3 +77,27 @@
     python_version = "3.11",
     requirements_lock = "//docs/sphinx:requirements.txt",
 )
+
+bazel_binaries = use_extension(
+    "@rules_bazel_integration_test//:extensions.bzl",
+    "bazel_binaries",
+    dev_dependency = True,
+)
+
+# Keep in sync with //:version.bzl
+bazel_binaries.local(
+    name = "self",
+    path = "tests/integration/bazel_from_env",
+)
+bazel_binaries.download(version = "6.4.0")
+bazel_binaries.download(version = "rolling")
+use_repo(
+    bazel_binaries,
+    "bazel_binaries",
+    # These don't appear necessary, but are reported as direct dependencies
+    # that should be use_repo()'d, so we add them as requested
+    "bazel_binaries_bazelisk",
+    "build_bazel_bazel_6_4_0",
+    "build_bazel_bazel_rolling",
+    "build_bazel_bazel_self",
+)
diff --git a/examples/BUILD.bazel b/examples/BUILD.bazel
index e11728e..f6372ea 100644
--- a/examples/BUILD.bazel
+++ b/examples/BUILD.bazel
@@ -12,6 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-package(default_visibility = ["//visibility:public"])
-
 licenses(["notice"])  # Apache 2.0
diff --git a/gazelle/BUILD.bazel b/gazelle/BUILD.bazel
index 7a4d4c0..e00c74a 100644
--- a/gazelle/BUILD.bazel
+++ b/gazelle/BUILD.bazel
@@ -28,6 +28,7 @@
     name = "distribution",
     srcs = [
         ":BUILD.bazel",
+        ":MODULE.bazel",
         ":README.md",
         ":WORKSPACE",
         ":def.bzl",
diff --git a/internal_deps.bzl b/internal_deps.bzl
index 3044e11..3835cd6 100644
--- a/internal_deps.bzl
+++ b/internal_deps.bzl
@@ -157,6 +157,23 @@
     )
 
     http_archive(
+        name = "rules_bazel_integration_test",
+        sha256 = "6e65d497c68f5794349bfa004369e144063686ce1ebd0227717cd23285be45ef",
+        urls = [
+            "https://github.com/bazel-contrib/rules_bazel_integration_test/releases/download/v0.20.0/rules_bazel_integration_test.v0.20.0.tar.gz",
+        ],
+    )
+
+    # Dependency of rules_bazel_integration_test.
+    http_archive(
+        name = "cgrindel_bazel_starlib",
+        sha256 = "9090280a9cff7322e7c22062506b3273a2e880ca464e520b5c77fdfbed4e8805",
+        urls = [
+            "https://github.com/cgrindel/bazel-starlib/releases/download/v0.18.1/bazel-starlib.v0.18.1.tar.gz",
+        ],
+    )
+
+    http_archive(
         name = "rules_proto",
         sha256 = "dc3fb206a2cb3441b485eb1e423165b231235a1ea9b031b4433cf7bc1fa460dd",
         strip_prefix = "rules_proto-5.3.0-21.7",
diff --git a/internal_setup.bzl b/internal_setup.bzl
index 9c6b080..a80099f 100644
--- a/internal_setup.bzl
+++ b/internal_setup.bzl
@@ -15,8 +15,12 @@
 """Setup for rules_python tests and tools."""
 
 load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
+load("@cgrindel_bazel_starlib//:deps.bzl", "bazel_starlib_dependencies")
 load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+load("@rules_bazel_integration_test//bazel_integration_test:deps.bzl", "bazel_integration_test_rules_dependencies")
+load("@rules_bazel_integration_test//bazel_integration_test:repo_defs.bzl", "bazel_binaries")
 load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
+load("//:version.bzl", "SUPPORTED_BAZEL_VERSIONS")
 load("//python/pip_install:repositories.bzl", "pip_install_dependencies")
 load("//python/private:internal_config_repo.bzl", "internal_config_repo")  # buildifier: disable=bzl-visibility
 
@@ -34,3 +38,7 @@
     rules_proto_toolchains()
 
     protobuf_deps()
+
+    bazel_integration_test_rules_dependencies()
+    bazel_starlib_dependencies()
+    bazel_binaries(versions = SUPPORTED_BAZEL_VERSIONS)
diff --git a/python/entry_points/BUILD.bazel b/python/entry_points/BUILD.bazel
index 981a1cc..d45fb18 100644
--- a/python/entry_points/BUILD.bazel
+++ b/python/entry_points/BUILD.bazel
@@ -34,6 +34,8 @@
     name = "distribution",
     srcs = glob([
         "*.bzl",
-    ]),
+    ]) + [
+        "BUILD.bazel",
+    ],
     visibility = ["//python:__subpackages__"],
 )
diff --git a/python/pip_install/BUILD.bazel b/python/pip_install/BUILD.bazel
index a22b9f3..4bcd5b8 100644
--- a/python/pip_install/BUILD.bazel
+++ b/python/pip_install/BUILD.bazel
@@ -69,6 +69,7 @@
     name = "distribution",
     srcs = glob(["*.bzl"]) + [
         "BUILD.bazel",
+        "pip_repository_requirements.bzl.tmpl",
         "//python/pip_install/private:distribution",
         "//python/pip_install/tools/dependency_resolver:distribution",
         "//python/pip_install/tools/wheel_installer:distribution",
diff --git a/tests/integration/BUILD.bazel b/tests/integration/BUILD.bazel
new file mode 100644
index 0000000..e7f700a
--- /dev/null
+++ b/tests/integration/BUILD.bazel
@@ -0,0 +1,93 @@
+# Copyright 2023 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_bazel_integration_test//bazel_integration_test:defs.bzl", "default_test_runner")
+load(":integration_test.bzl", "rules_python_integration_test")
+
+licenses(["notice"])
+
+_WORKSPACE_FLAGS = [
+    "--noenable_bzlmod",
+]
+
+_WORKSPACE_GAZELLE_PLUGIN_FLAGS = [
+    "--override_repository=rules_python_gazelle_plugin=../../../rules_python_gazelle_plugin",
+]
+
+_GAZELLE_PLUGIN_FLAGS = [
+    "--override_module=rules_python_gazelle_plugin=../../../rules_python_gazelle_plugin",
+]
+
+default_test_runner(
+    name = "workspace_test_runner",
+    bazel_cmds = [
+        "info {}".format(" ".join(_WORKSPACE_FLAGS)),
+        "test {} //...".format(" ".join(_WORKSPACE_FLAGS)),
+    ],
+    visibility = ["//visibility:public"],
+)
+
+default_test_runner(
+    name = "workspace_test_runner_gazelle_plugin",
+    bazel_cmds = [
+        "info {}".format(" ".join(_WORKSPACE_FLAGS + _WORKSPACE_GAZELLE_PLUGIN_FLAGS)),
+        "test {} //...".format(" ".join(_WORKSPACE_FLAGS + _WORKSPACE_GAZELLE_PLUGIN_FLAGS)),
+    ],
+    visibility = ["//visibility:public"],
+)
+
+default_test_runner(
+    name = "test_runner",
+    visibility = ["//visibility:public"],
+)
+
+default_test_runner(
+    name = "test_runner_gazelle_plugin",
+    bazel_cmds = [
+        "info {}".format(" ".join(_GAZELLE_PLUGIN_FLAGS)),
+        "test {} //...".format(" ".join(_GAZELLE_PLUGIN_FLAGS)),
+    ],
+    visibility = ["//visibility:public"],
+)
+
+# TODO: add compile_pip_requirements_test_from_external_repo
+
+rules_python_integration_test(
+    name = "pip_repository_entry_points_workspace_test",
+    timeout = "long",
+    bzlmod = False,
+    # The dependencies needed for this test are not cross-platform: https://github.com/bazelbuild/rules_python/issues/260
+    tags = ["fix-windows"],
+    workspace_path = "pip_repository_entry_points",
+)
+
+rules_python_integration_test(
+    name = "compile_pip_requirements_test",
+)
+
+rules_python_integration_test(
+    name = "compile_pip_requirements_workspace_test",
+    bzlmod = False,
+    workspace_path = "compile_pip_requirements",
+)
+
+rules_python_integration_test(
+    name = "ignore_root_user_error_test",
+)
+
+rules_python_integration_test(
+    name = "ignore_root_user_error_workspace_test",
+    bzlmod = False,
+    workspace_path = "ignore_root_user_error",
+)
diff --git a/tests/integration/bazel_from_env b/tests/integration/bazel_from_env
new file mode 100755
index 0000000..96780b8
--- /dev/null
+++ b/tests/integration/bazel_from_env
@@ -0,0 +1,6 @@
+#!/bin/bash
+#
+# A simple wrapper so rules_bazel_integration_test can use the
+# bazel version inherited from the environment.
+
+bazel "$@"
diff --git a/tests/integration/integration_test.bzl b/tests/integration/integration_test.bzl
new file mode 100644
index 0000000..16d6a5a
--- /dev/null
+++ b/tests/integration/integration_test.bzl
@@ -0,0 +1,96 @@
+# Copyright 2023 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Helpers for running bazel-in-bazel integration tests."""
+
+load("@bazel_binaries//:defs.bzl", "bazel_binaries")
+load(
+    "@rules_bazel_integration_test//bazel_integration_test:defs.bzl",
+    "bazel_integration_tests",
+    "integration_test_utils",
+)
+
+def rules_python_integration_test(
+        name,
+        workspace_path = None,
+        bzlmod = True,
+        gazelle_plugin = False,
+        tags = None,
+        **kwargs):
+    """Runs a bazel-in-bazel integration test.
+
+    Args:
+        name: Name of the test. This gets appended by the bazel version.
+        workspace_path: The directory name. Defaults to `name` without the
+            `_test` suffix.
+        bzlmod: bool, default True. If true, run with bzlmod enabled, otherwise
+            disable bzlmod.
+        gazelle_plugin: Whether the test uses the gazelle plugin.
+        tags: Test tags.
+        **kwargs: Passed to the upstream `bazel_integration_tests` rule.
+    """
+    workspace_path = workspace_path or name.removesuffix("_test")
+    if bzlmod:
+        if gazelle_plugin:
+            test_runner = "//tests/integration:test_runner_gazelle_plugin"
+        else:
+            test_runner = "//tests/integration:test_runner"
+    elif gazelle_plugin:
+        test_runner = "//tests/integration:workspace_test_runner_gazelle_plugin"
+    else:
+        test_runner = "//tests/integration:workspace_test_runner"
+
+    # Because glob expansion happens at loading time, the bazel-* symlinks
+    # in the workspaces can recursively expand to tens-of-thousands of entries,
+    # which consumes lots of CPU and RAM and can render the system unusable.
+    # To help prevent that, cap the size of the glob expansion.
+    workspace_files = integration_test_utils.glob_workspace_files(workspace_path)
+    if len(workspace_files) > 1000:
+        fail("Workspace {} has too many files. This likely means a bazel-* " +
+             "symlink is being followed when it should be ignored.")
+
+    # bazel_integration_tests creates a separate file group target of the workspace
+    # files for each bazel version, even though the file groups are the same
+    # for each one.
+    # To avoid that, manually create a single filegroup once and re-use it.
+    native.filegroup(
+        name = name + "_workspace_files",
+        srcs = workspace_files + [
+            "//:distribution",
+        ],
+    )
+    kwargs.setdefault("size", "enormous")
+    bazel_integration_tests(
+        name = name,
+        workspace_path = workspace_path,
+        test_runner = test_runner,
+        bazel_versions = bazel_binaries.versions.all,
+        workspace_files = [name + "_workspace_files"],
+        # Override the tags so that the `manual` tag isn't applied.
+        tags = (tags or []) + [
+            # These tests are very heavy weight, so much so that only a couple
+            # can be run in parallel without harming their reliability,
+            # overall runtime, and the system's stability. Unfortunately,
+            # there doesn't appear to be a way to tell Bazel to limit their
+            # concurrency, only disable it entirely with exclusive.
+            "exclusive",
+            # The default_test_runner() assumes it can write to the user's home
+            # directory for caching purposes. Give it access.
+            "no-sandbox",
+            # The CI RBE setup can't successfully run these tests remotely.
+            "no-remote-exec",
+            # A special tag is used so CI can run them as a separate job.
+            "integration-test",
+        ],
+        **kwargs
+    )
diff --git a/version.bzl b/version.bzl
index bcc2b20..2e8fc0b 100644
--- a/version.bzl
+++ b/version.bzl
@@ -21,18 +21,18 @@
 
 # NOTE: Keep in sync with .bazelci/presubmit.yml
 # This is the minimum supported bazel version, that we have some tests for.
-MINIMUM_BAZEL_VERSION = "6.2.0"
+MINIMUM_BAZEL_VERSION = "6.4.0"
 
 # Versions of Bazel which users should be able to use.
 # Ensures we don't break backwards-compatibility,
 # accidentally forcing users to update their LTS-supported bazel.
 # These are the versions used when testing nested workspaces with
-# bazel_integration_test.
+# rules_bazel_integration_test.
+#
+# Keep in sync with MODULE.bazel's bazel_binaries config
 SUPPORTED_BAZEL_VERSIONS = [
     BAZEL_VERSION,
-    # TODO @aignas 2023-02-15: the integration tests currently support
-    # only a single element in this array.
-    #MINIMUM_BAZEL_VERSION,
+    MINIMUM_BAZEL_VERSION,
 ]
 
 def bazel_version_to_binary_label(version):