diff --git a/build/root/.kazelcfg.json b/build/root/.kazelcfg.json
index e8f32e586d3..3d5d1a1edb7 100644
--- a/build/root/.kazelcfg.json
+++ b/build/root/.kazelcfg.json
@@ -4,6 +4,5 @@
 		"^_.*"
 	],
 	"AddSourcesRules": true,
-	"VendorMultipleBuildFiles": true,
 	"K8sOpenAPIGen": true
 }
diff --git a/build/root/BUILD.root b/build/root/BUILD.root
index de10cbaafda..58e2dadd952 100644
--- a/build/root/BUILD.root
+++ b/build/root/BUILD.root
@@ -1,3 +1,8 @@
+# gazelle:exclude _artifacts
+# gazelle:exclude _gopath
+# gazelle:exclude _output
+# gazelle:exclude _tmp
+
 package(default_visibility = ["//visibility:public"])
 
 licenses(["notice"])
diff --git a/build/root/WORKSPACE b/build/root/WORKSPACE
index 53fb0ef1836..866af12da0e 100644
--- a/build/root/WORKSPACE
+++ b/build/root/WORKSPACE
@@ -7,9 +7,9 @@ http_archive(
 
 http_archive(
     name = "io_kubernetes_build",
-    sha256 = "232fec0ffcb53df5e87fc036ae3e966ea32122fc89ead4c32581b3255c1ab7d0",
-    strip_prefix = "repo-infra-f521b5d472e00e05da5394994942064510a6e8bf",
-    urls = ["https://github.com/kubernetes/repo-infra/archive/f521b5d472e00e05da5394994942064510a6e8bf.tar.gz"],
+    sha256 = "5ba54d17d582ec099ba65d4e409e318e209216b15be819c922a5baae3f4d4283",
+    strip_prefix = "repo-infra-e9d1a126ef355ff5d38e20612c889b07728225a4",
+    urls = ["https://github.com/kubernetes/repo-infra/archive/e9d1a126ef355ff5d38e20612c889b07728225a4.tar.gz"],
 )
 
 ETCD_VERSION = "3.0.17"
diff --git a/hack/update-bazel.sh b/hack/update-bazel.sh
index 9a138ca10bb..bf841685b79 100755
--- a/hack/update-bazel.sh
+++ b/hack/update-bazel.sh
@@ -24,6 +24,9 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 # TODO(spxtr): Remove this line once Bazel is the only way to build.
 rm -f "${KUBE_ROOT}/pkg/generated/openapi/zz_generated.openapi.go"
 
-kube::util::go_install_from_commit github.com/kubernetes/repo-infra/kazel d651a70c51ec9a450135ff08ea045d857a6be014
+# The git commit sha1s here should match the values in $KUBE_ROOT/WORKSPACE.
+kube::util::go_install_from_commit github.com/kubernetes/repo-infra/kazel e9d1a126ef355ff5d38e20612c889b07728225a4
+kube::util::go_install_from_commit github.com/bazelbuild/rules_go/go/tools/gazelle/gazelle 82483596ec203eb9c1849937636f4cbed83733eb
 
+gazelle fix -build_file_name=BUILD,BUILD.bazel -external=vendored -mode=fix -repo_root="$(kube::realpath ${KUBE_ROOT})"
 kazel -root="$(kube::realpath ${KUBE_ROOT})"
diff --git a/hack/verify-bazel.sh b/hack/verify-bazel.sh
index 4757a1eaf8e..07a3bd7ecab 100755
--- a/hack/verify-bazel.sh
+++ b/hack/verify-bazel.sh
@@ -24,9 +24,16 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 # TODO(spxtr): Remove this line once Bazel is the only way to build.
 rm -f "${KUBE_ROOT}/pkg/generated/openapi/zz_generated.openapi.go"
 
-kube::util::go_install_from_commit github.com/kubernetes/repo-infra/kazel d651a70c51ec9a450135ff08ea045d857a6be014
+# The git commit sha1s here should match the values in $KUBE_ROOT/WORKSPACE.
+kube::util::go_install_from_commit github.com/kubernetes/repo-infra/kazel e9d1a126ef355ff5d38e20612c889b07728225a4
+kube::util::go_install_from_commit github.com/bazelbuild/rules_go/go/tools/gazelle/gazelle 82483596ec203eb9c1849937636f4cbed83733eb
 
-if ! kazel -validate -print-diff -root="$(kube::realpath ${KUBE_ROOT})" ; then
+gazelle_diff=$(gazelle fix -build_file_name=BUILD,BUILD.bazel -external=vendored -mode=diff -repo_root="$(kube::realpath ${KUBE_ROOT})")
+kazel_diff=$(kazel -dry-run -print-diff -root="$(kube::realpath ${KUBE_ROOT})")
+
+if [[ -n "${gazelle_diff}" || -n "${kazel_diff}" ]]; then
+  echo "${gazelle_diff}"
+  echo "${kazel_diff}"
   echo
   echo "Run ./hack/update-bazel.sh"
   exit 1
diff --git a/pkg/generated/openapi/BUILD b/pkg/generated/openapi/BUILD
index 280367f267b..b7104b28ce3 100644
--- a/pkg/generated/openapi/BUILD
+++ b/pkg/generated/openapi/BUILD
@@ -1,3 +1,6 @@
+# doc.go is managed by kazel, so gazelle should ignore it.
+# gazelle:exclude doc.go
+
 package(default_visibility = ["//visibility:public"])
 
 load("//pkg/generated/openapi:def.bzl", "openapi_library")