diff --git a/WORKSPACE b/WORKSPACE
index 0cc57de..50dab01 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -1,8 +1,51 @@
 # This file existed originally to enable quick local development via local_repository.
-    # See ./ImplementationReadme.md for details on local development.
-    # Why? local_repository didn't work without a WORKSPACE, and new_local_repository required overwriting the BUILD file (as of Bazel 5.0).
+# See ./ImplementationReadme.md for details on local development.
+# Why? local_repository didn't work without a WORKSPACE, and new_local_repository required overwriting the BUILD file (as of Bazel 5.0).
 
 workspace(name = "hedron_compile_commands")
 
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+# TODO(cpsauer): move everything above hedron_compile_commands_setup() into setup macros.
+BAZEL_SKYLIB_VERSION = "1.4.2"
+
+http_archive(
+    name = "bazel_skylib",
+    sha256 = "66ffd9315665bfaafc96b52278f57c7e2dd09f5ede279ea6d39b2be471e7e3aa",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/{0}/bazel-skylib-{0}.tar.gz".format(BAZEL_SKYLIB_VERSION),
+        "https://github.com/bazelbuild/bazel-skylib/releases/download/{0}/bazel-skylib-{0}.tar.gz".format(BAZEL_SKYLIB_VERSION),
+    ],
+)
+
+http_archive(
+    name = "rules_python",
+    sha256 = "84aec9e21cc56fbc7f1335035a71c850d1b9b5cc6ff497306f84cced9a769841",
+    strip_prefix = "rules_python-0.23.1",
+    url = "https://github.com/bazelbuild/rules_python/releases/download/0.23.1/rules_python-0.23.1.tar.gz",
+)
+
+load("@rules_python//python:repositories.bzl", "python_register_toolchains")
+
+python_register_toolchains(
+    name = "python_toolchain",
+    python_version = "3.11",
+)
+
+# For re-generating python_requirements_lock.bzl:
+# * update python_requirements_lock.txt
+# * Un-comment the below
+# * run `bazel build @pip//...`,
+# * cp external/pip/requirements.bzl python_requirements_lock.bzl
+
+# load("@python_toolchain//:defs.bzl", "interpreter")
+# load("@rules_python//python:pip.bzl", "pip_parse")
+# pip_parse(
+#     name = "pip",
+#     python_interpreter_target = interpreter,
+#     requirements_lock = "//:python_requirements_lock.txt",
+# )
+
 load("@hedron_compile_commands//:workspace_setup.bzl", "hedron_compile_commands_setup")
+
 hedron_compile_commands_setup()
diff --git a/python_requirements_lock.bzl b/python_requirements_lock.bzl
new file mode 100755
index 0000000..26a20fc
--- /dev/null
+++ b/python_requirements_lock.bzl
@@ -0,0 +1,52 @@
+"""Starlark representation of locked requirements.
+
+@generated by rules_python pip_parse repository rule
+from @//:python_requirements_lock.txt
+"""
+
+load("@rules_python//python/pip_install:pip_repository.bzl", "whl_library")
+
+all_requirements = ["@pip_orjson//:pkg"]
+
+all_whl_requirements = ["@pip_orjson//:whl"]
+
+_packages = [("pip_orjson", "orjson==3.9.1")]
+_config = {"download_only": False, "enable_implicit_namespace_pkgs": False, "environment": {}, "extra_pip_args": [], "isolated": True, "pip_data_exclude": [], "python_interpreter": "python3", "python_interpreter_target": "@python_toolchain_x86_64-unknown-linux-gnu//:bin/python3", "quiet": True, "repo": "pip", "repo_prefix": "pip_", "timeout": 600}
+_annotations = {}
+
+def _clean_name(name):
+    return name.replace("-", "_").replace(".", "_").lower()
+
+def requirement(name):
+    return "@pip_" + _clean_name(name) + "//:pkg"
+
+def whl_requirement(name):
+    return "@pip_" + _clean_name(name) + "//:whl"
+
+def data_requirement(name):
+    return "@pip_" + _clean_name(name) + "//:data"
+
+def dist_info_requirement(name):
+    return "@pip_" + _clean_name(name) + "//:dist_info"
+
+def entry_point(pkg, script = None):
+    if not script:
+        script = pkg
+    return "@pip_" + _clean_name(pkg) + "//:rules_python_wheel_entry_point_" + script
+
+def _get_annotation(requirement):
+    # This expects to parse `setuptools==58.2.0     --hash=sha256:2551203ae6955b9876741a26ab3e767bb3242dafe86a32a749ea0d78b6792f11`
+    # down to `setuptools`.
+    name = requirement.split(" ")[0].split("=")[0].split("[")[0]
+    return _annotations.get(name)
+
+def install_deps(**whl_library_kwargs):
+    whl_config = dict(_config)
+    whl_config.update(whl_library_kwargs)
+    for name, requirement in _packages:
+        whl_library(
+            name = name,
+            requirement = requirement,
+            annotation = _get_annotation(requirement),
+            **whl_config
+        )
diff --git a/python_requirements_lock.txt b/python_requirements_lock.txt
new file mode 100644
index 0000000..c86bdcb
--- /dev/null
+++ b/python_requirements_lock.txt
@@ -0,0 +1 @@
+orjson==3.9.1
diff --git a/refresh_compile_commands.bzl b/refresh_compile_commands.bzl
index 537c9fc..d4e5625 100644
--- a/refresh_compile_commands.bzl
+++ b/refresh_compile_commands.bzl
@@ -52,11 +52,11 @@ refresh_compile_commands(
 ```
 """
 
-
 ########################################
 # Implementation
 
 load("@bazel_tools//tools/cpp:toolchain_utils.bzl", "find_cpp_toolchain")
+load("@rules_python//python:defs.bzl", "py_binary")
 
 def refresh_compile_commands(
         name,
@@ -99,6 +99,7 @@ def refresh_compile_commands(
             script_name,
         ],
         imports = [''], # Allows binary to import templated script, even if this macro is being called inside a sub package. See https://github.com/hedronvision/bazel-compile-commands-extractor/issues/137
+        deps = ["@pip_orjson//:pkg"],
         **kwargs
     )
 
diff --git a/requirements.bzl b/requirements.bzl
new file mode 100644
index 0000000..e69de29
diff --git a/workspace_setup.bzl b/workspace_setup.bzl
index bcce1d0..98f1798 100644
--- a/workspace_setup.bzl
+++ b/workspace_setup.bzl
@@ -1,5 +1,9 @@
+"""Workspace setup macros."""
+
 # Do not change the filename; it is part of the user interface.
 
+load("//:python_requirements_lock.bzl", install_python_deps = "install_deps")
+
 def hedron_compile_commands_setup():
     """Set up a WORKSPACE to have hedron_compile_commands used within it."""
 
@@ -7,7 +11,4 @@ def hedron_compile_commands_setup():
     # See invocations in:
     #     README.md (for users)
     #     WORKSPACE (for working on this repo standalone)
-
-    # Currently nothing to do -> no-op.
-    # So why is this even here? Enables future expansion (e.g to add transitive dependencies) without changing the user interface.
-    pass
+    install_python_deps()