diff --git a/.bazelversion b/.bazelversion
new file mode 100644
index 000000000000..fcdb2e109f68
--- /dev/null
+++ b/.bazelversion
@@ -0,0 +1 @@
+4.0.0
diff --git a/Makefile b/Makefile
index 0e2cee2ed06d..3fb24908daf2 100644
--- a/Makefile
+++ b/Makefile
@@ -319,12 +319,8 @@ $(info $(yellow)Warning: 'ccache' not found, consider installing it for faster b
 endif
 
 # Warn maintainers if bazel is not found.
-#
-# TODO(irfansharif): Assert here instead, on a fixed version of bazel (3.7.0). Something like:
-#
-#   $(error $(yellow)'bazel' not found (`brew install bazel` for macs)$(term-reset))
 ifeq (, $(shell which bazel))
-$(info $(yellow)Warning: 'bazel' not found (`brew install bazel` for macs)$(term-reset))
+$(info $(yellow)Warning: 'bazel' not found (`brew install bazelisk` for macs)$(term-reset))
 endif
 
 # Force vendor directory to rebuild.
diff --git a/WORKSPACE b/WORKSPACE
index ec7bd2b06431..81f06d954a40 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -60,11 +60,6 @@ yarn_install(
     yarn_lock = "//pkg/ui:yarn.lock",
 )
 
-# NB: @bazel_skylib comes from go_rules_dependencies().
-load("@bazel_skylib//lib:versions.bzl", "versions")
-
-versions.check(minimum_bazel_version = "4.0.0")
-
 # Load gazelle dependencies.
 load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
 
diff --git a/build/bazelbuilder/Dockerfile b/build/bazelbuilder/Dockerfile
index 35cfeab1405d..956d0f7218e3 100644
--- a/build/bazelbuilder/Dockerfile
+++ b/build/bazelbuilder/Dockerfile
@@ -10,6 +10,7 @@ RUN apt-get update \
     cmake \
     curl \
     flex \
+    g++ \
     git \
     gnupg2 \
     libncurses-dev \
@@ -32,14 +33,9 @@ RUN curl -fsSL https://github.com/Kitware/CMake/releases/download/v3.20.3/cmake-
  && tar --strip-components=1 -C /usr -xzf cmake.tar.gz \
  && rm cmake.tar.gz
 
-RUN echo "deb [arch=amd64] https://storage.googleapis.com/bazel-apt stable jdk1.8" | tee /etc/apt/sources.list.d/bazel.list \
- && curl https://bazel.build/bazel-release.pub.gpg | apt-key add - \
- && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-    bazel-4.0.0
-
 # git - Upgrade to a more modern version
-RUN DEBIAN_FRONTEND=noninteractive apt-get install dh-autoreconf libcurl4-gnutls-dev libexpat1-dev gettext libz-dev libssl-dev -y && \
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install dh-autoreconf libcurl4-gnutls-dev libexpat1-dev gettext libz-dev libssl-dev -y && \
     curl -fsSL https://github.com/git/git/archive/v2.29.2.zip -o "git-2.29.2.zip" && \
     unzip "git-2.29.2.zip" && \
     cd git-2.29.2 && \
@@ -56,9 +52,15 @@ RUN apt-get purge -y \
     gettext \
  && apt-get autoremove -y
 
-RUN rm -rf /tmp/* /var/lib/apt/lists/*
+# Install Bazelisk as Bazel.
+# NOTE: you should keep this in sync with build/packer/teamcity-agent.sh -- if
+# an update is necessary here, it's probably necessary in the agent as well.
+RUN curl -fsSL https://github.com/bazelbuild/bazelisk/releases/download/v1.10.1/bazelisk-linux-amd64 > /tmp/bazelisk \
+ && echo '4cb534c52cdd47a6223d4596d530e7c9c785438ab3b0a49ff347e991c210b2cd /tmp/bazelisk' | sha256sum -c - \
+ && chmod +x /tmp/bazelisk \
+ && mv /tmp/bazelisk /usr/bin/bazel
 
-RUN ln -s /usr/bin/bazel-4.0.0 /usr/bin/bazel
+RUN rm -rf /tmp/* /var/lib/apt/lists/*
 
 COPY entrypoint.sh /usr/bin
 COPY autom4te /usr/local/sbin
diff --git a/build/packer/teamcity-agent.sh b/build/packer/teamcity-agent.sh
index 6ba846b98ed4..a92422077e59 100644
--- a/build/packer/teamcity-agent.sh
+++ b/build/packer/teamcity-agent.sh
@@ -64,6 +64,7 @@ for f in `ls /usr/local/go/bin`; do
 done
 
 # Install Bazelisk.
+# Keep this in sync with `build/bazelbuilder/Dockerfile`.
 curl -fsSL https://github.com/bazelbuild/bazelisk/releases/download/v1.10.1/bazelisk-linux-amd64 > /tmp/bazelisk
 sha256sum -c - <<EOF
 4cb534c52cdd47a6223d4596d530e7c9c785438ab3b0a49ff347e991c210b2cd /tmp/bazelisk
diff --git a/build/teamcity-bazel-support.sh b/build/teamcity-bazel-support.sh
index 35439e6d2718..97bf7290ddae 100644
--- a/build/teamcity-bazel-support.sh
+++ b/build/teamcity-bazel-support.sh
@@ -1,7 +1,7 @@
 # FYI: You can run `./dev builder` to run this Docker image. :)
 # `dev` depends on this variable! Don't change the name or format unless you
 # also update `dev` accordingly.
-BAZEL_IMAGE=cockroachdb/bazel:20210723-114244
+BAZEL_IMAGE=cockroachdb/bazel:20210729-154657
 
 # Call `run_bazel $NAME_OF_SCRIPT` to start an appropriately-configured Docker
 # container with the `cockroachdb/bazel` image running the given script.
diff --git a/tools/bazel b/tools/bazel
new file mode 100755
index 000000000000..8431a1d1f731
--- /dev/null
+++ b/tools/bazel
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+# Bazel calls into this script, setting `BAZEL_REAL` to the location of
+# the "actual" Bazel binary, expecting this script to call into Bazel
+# appropriately. We output a helpful error message as suggested in
+# https://github.com/bazelbuild/bazelisk#ensuring-that-your-developers-use-bazelisk-rather-than-bazel
+
+if [ -z "$BAZELISK_SKIP_WRAPPER" ] && [ -z "$SHUT_UP_ABOUT_BAZELISK" ]
+then
+    echo "You're not using Bazelisk! Your build may fail due to a mismatched"
+    echo "Bazel version. Using Bazelisk is recommended."
+    echo "On macOS, you can install Bazelisk with:"
+    echo "    brew uninstall bazel; brew install bazelisk"
+fi
+
+$BAZEL_REAL "$@"