diff --git a/hack/update-bazel.sh b/hack/update-bazel.sh
index a3a2e59fb56..4f42d098340 100755
--- a/hack/update-bazel.sh
+++ b/hack/update-bazel.sh
@@ -37,5 +37,13 @@ touch "${KUBE_ROOT}/vendor/BUILD"
 gazelle fix \
     -build_file_name=BUILD,BUILD.bazel \
     -external=vendored \
+    -proto=legacy \
     -mode=fix
+# gazelle gets confused by our staging/ directory, prepending an extra
+# "k8s.io/kubernetes/staging/src" to the import path.
+# gazelle won't follow the symlinks in vendor/, so we can't just exclude
+# staging/. Instead we just fix the bad paths with sed.
+find staging -name BUILD -o -name BUILD.bazel | \
+  xargs sed -i 's|\(importpath = "\)k8s.io/kubernetes/staging/src/\(.*\)|\1\2|'
+
 kazel
diff --git a/hack/verify-bazel.sh b/hack/verify-bazel.sh
index 36fc2c17a0e..f7eda19365b 100755
--- a/hack/verify-bazel.sh
+++ b/hack/verify-bazel.sh
@@ -31,20 +31,21 @@ fi
 # TODO(spxtr): Remove this line once Bazel is the only way to build.
 rm -f "${KUBE_ROOT}/pkg/generated/openapi/zz_generated.openapi.go"
 
-# The git commit sha1s here should match the values in $KUBE_ROOT/WORKSPACE.
-kube::util::go_install_from_commit \
-    github.com/kubernetes/repo-infra/kazel \
-    e26fc85d14a1d3dc25569831acc06919673c545a
-kube::util::go_install_from_commit \
-    github.com/bazelbuild/rules_go/go/tools/gazelle/gazelle \
-    a280fbac1a0a4c67b0eee660b4fd1b3db7c9f058
+_tmpdir="$(mktemp -d -t verify-bazel.XXXXXX)"
+kube::util::trap_add "rm -rf ${_tmpdir}" EXIT
 
-gazelle_diff=$(gazelle fix -build_file_name=BUILD,BUILD.bazel -external=vendored -mode=diff -repo_root="$(kube::realpath ${KUBE_ROOT})")
-kazel_diff=$(kazel -dry-run -print-diff -root="$(kube::realpath ${KUBE_ROOT})")
+_tmp_gopath="${_tmpdir}/go"
+_tmp_kuberoot="${_tmp_gopath}/src/k8s.io/kubernetes"
+mkdir -p "${_tmp_kuberoot}/.."
+cp -a "${KUBE_ROOT}" "${_tmp_kuberoot}/.."
 
-if [[ -n "${gazelle_diff}" || -n "${kazel_diff}" ]]; then
-  echo "${gazelle_diff}"
-  echo "${kazel_diff}"
+cd "${_tmp_kuberoot}"
+GOPATH="${_tmp_gopath}" ./hack/update-bazel.sh
+
+diff=$(diff -Naupr "${KUBE_ROOT}" "${_tmp_kuberoot}" || true)
+
+if [[ -n "${diff}" ]]; then
+  echo "${diff}"
   echo
   echo "Run ./hack/update-bazel.sh"
   exit 1