diff --git a/bazel/check_deps/BUILD b/bazel/check_deps/BUILD
index 7064e036d686..860155ab1c42 100644
--- a/bazel/check_deps/BUILD
+++ b/bazel/check_deps/BUILD
@@ -14,9 +14,11 @@ filegroup(
     name = "non_test_cc_rules",
     data = [
         "//executable_semantics",
+        "//installers/local:carbon",
         "//migrate_cpp/cpp_refactoring",
         "//toolchain/diagnostics:null_diagnostics",
         "//toolchain/driver:carbon",
+        "//toolchain/semantics:semantics_ir_factory",
     ],
 )
 
diff --git a/bazel/check_deps/check_non_test_cc_deps.py b/bazel/check_deps/check_non_test_cc_deps.py
index 29a1b51e72ed..ad6946a9b81f 100644
--- a/bazel/check_deps/check_non_test_cc_deps.py
+++ b/bazel/check_deps/check_non_test_cc_deps.py
@@ -61,9 +61,10 @@ for dep in deps:
         # distributed and so should be fine.
         continue
     if repo in (
+        "@com_github_google_benchmark",
+        "@com_github_protocolbuffers_protobuf",
         "@com_google_absl",
         "@com_google_googletest",
-        "@com_github_google_benchmark",
     ):
         # This should never be reached from non-test code, but these targets do
         # exist. Specially diagnose them to try to provide a more helpful
diff --git a/bazel/check_deps/update_roots.py b/bazel/check_deps/update_roots.py
index 76816c5a4c50..ac05eb25c881 100755
--- a/bazel/check_deps/update_roots.py
+++ b/bazel/check_deps/update_roots.py
@@ -13,38 +13,17 @@ SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 """
 
 import os
-import shutil
 import subprocess
-import sys
 from pathlib import Path
 
 # Change the working directory to the repository root so that the remaining
 # operations reliably operate relative to that root.
-os.chdir(Path(__file__).parent.parent)
-directory = Path.cwd()
-
-# Use the `BAZEL` environment variable if present. If not, then try to use
-# `bazelisk` and then `bazel`.
-bazel = os.environ.get("BAZEL")
-if not bazel:
-    bazel = "bazelisk"
-    if not shutil.which(bazel):
-        bazel = "bazel"
-        if not shutil.which(bazel):
-            sys.exit("Unable to run Bazel")
-
-# Use the `BUILDOZER` environment variable if present. If not, then try to use
-# `buildozer`.
-buildozer = os.environ.get("BUILDOZER")
-if not buildozer:
-    buildozer = "buildozer"
-    if not shutil.which(buildozer):
-        sys.exit("Unable to run Buildozer")
+os.chdir(Path(__file__).parent.parent.parent)
 
 print("Compute non-test C++ root targets...")
-non_test_cc_roots_query = subprocess.run(
+non_test_cc_roots_query = subprocess.check_output(
     [
-        bazel,
+        "./scripts/run_bazel.py",
         "query",
         "--noshow_progress",
         "--noimplicit_deps",
@@ -55,10 +34,8 @@ non_test_cc_roots_query = subprocess.run(
             ' in kind("cc.* rule", deps($non_tests))'
         ),
     ],
-    check=True,
-    stdout=subprocess.PIPE,
     universal_newlines=True,
-).stdout
+)
 ranked_targets = [line.split() for line in non_test_cc_roots_query.splitlines()]
 roots = [target for rank, target in ranked_targets if int(rank) == 0]
 print("Found roots:\n%s" % "\n".join(roots))
@@ -66,7 +43,7 @@ print("Found roots:\n%s" % "\n".join(roots))
 print("Replace non-test C++ roots in the BUILD file...")
 buildozer_run = subprocess.run(
     [
-        buildozer,
+        "./scripts/run_buildozer.py",
         "remove data",
     ]
     + ["add data '%s'" % root for root in roots]
diff --git a/common/fuzzing/BUILD b/common/fuzzing/BUILD
index be6e36bdf2a8..2716717173ac 100644
--- a/common/fuzzing/BUILD
+++ b/common/fuzzing/BUILD
@@ -14,11 +14,13 @@ proto_library(
 
 cc_proto_library(
     name = "carbon_cc_proto",
+    testonly = 1,
     deps = [":carbon_proto"],
 )
 
 cc_library(
     name = "proto_to_carbon_lib",
+    testonly = 1,
     srcs = ["proto_to_carbon.cpp"],
     hdrs = ["proto_to_carbon.h"],
     deps = [
diff --git a/executable_semantics/fuzzing/BUILD b/executable_semantics/fuzzing/BUILD
index 93d8c6625dc5..a4996b86d81a 100644
--- a/executable_semantics/fuzzing/BUILD
+++ b/executable_semantics/fuzzing/BUILD
@@ -6,6 +6,7 @@ load("//bazel/fuzzing:rules.bzl", "cc_fuzz_test")
 
 cc_library(
     name = "ast_to_proto_lib",
+    testonly = 1,
     srcs = ["ast_to_proto.cpp"],
     hdrs = ["ast_to_proto.h"],
     deps = [
@@ -19,6 +20,7 @@ cc_library(
 
 cc_library(
     name = "fuzzer_util",
+    testonly = 1,
     srcs = ["fuzzer_util.cpp"],
     hdrs = ["fuzzer_util.h"],
     deps = [
@@ -52,6 +54,7 @@ cc_test(
 
 cc_binary(
     name = "fuzzverter",
+    testonly = 1,
     srcs = ["fuzzverter.cpp"],
     deps = [
         ":ast_to_proto_lib",
diff --git a/installers/local/BUILD b/installers/local/BUILD
index 1c0d226950d0..cf85c4025794 100644
--- a/installers/local/BUILD
+++ b/installers/local/BUILD
@@ -60,6 +60,7 @@ sh_binary(
 cc_binary(
     name = "carbon",
     srcs = ["carbon.cpp"],
+    visibility = ["//bazel/check_deps:__pkg__"],
     deps = [
         "//executable_semantics:main",
         "@llvm-project//llvm:Support",
diff --git a/scripts/BUILD b/scripts/BUILD
index a8c271611f76..b9db9c19356b 100644
--- a/scripts/BUILD
+++ b/scripts/BUILD
@@ -54,6 +54,21 @@ mypy_test(
     deps = [":forbid_llvm_googletest"],
 )
 
+# Note that this Python script is intended to be run directly, and not through
+# Bazel. We have a rule for it so we can type check it.
+py_binary(
+    name = "run_bazel",
+    testonly = 1,
+    srcs = ["run_bazel.py"],
+    deps = [":scripts_utils"],
+)
+
+mypy_test(
+    name = "run_bazel_mypy_test",
+    include_imports = True,
+    deps = [":run_bazel"],
+)
+
 # Note that this Python script is intended to be run directly, and not through
 # Bazel. We have a rule for it so we can type check it.
 py_binary(
@@ -68,3 +83,18 @@ mypy_test(
     include_imports = True,
     deps = [":run_buildifier"],
 )
+
+# Note that this Python script is intended to be run directly, and not through
+# Bazel. We have a rule for it so we can type check it.
+py_binary(
+    name = "run_buildozer",
+    testonly = 1,
+    srcs = ["run_buildozer.py"],
+    deps = [":scripts_utils"],
+)
+
+mypy_test(
+    name = "run_buildozer_mypy_test",
+    include_imports = True,
+    deps = [":run_buildozer"],
+)
diff --git a/scripts/run_bazel.py b/scripts/run_bazel.py
new file mode 100755
index 000000000000..53c0abda5450
--- /dev/null
+++ b/scripts/run_bazel.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+
+"""Runs bazel on arguments.
+
+This is provided for other scripts to run bazel without requiring it be
+manually installed.
+"""
+
+__copyright__ = """
+Part of the Carbon Language project, under the Apache License v2.0 with LLVM
+Exceptions. See /LICENSE for license information.
+SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+"""
+
+import os
+import sys
+
+import scripts_utils  # type: ignore
+
+
+def main() -> None:
+    bazel = scripts_utils.locate_bazel()
+    os.execv(bazel, [bazel] + sys.argv[1:])
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/run_buildifier.py b/scripts/run_buildifier.py
index 37969e67f21c..61a8fb33021f 100755
--- a/scripts/run_buildifier.py
+++ b/scripts/run_buildifier.py
@@ -8,18 +8,15 @@ Exceptions. See /LICENSE for license information.
 SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 """
 
-import subprocess
+import os
 import sys
 
 import scripts_utils  # type: ignore
 
 
 def main() -> None:
-    files = sys.argv[1:]
-    if not files:
-        return
     buildifier = scripts_utils.get_release(scripts_utils.Release.BUILDIFIER)
-    subprocess.check_call([buildifier] + files)
+    os.execv(buildifier, [buildifier] + sys.argv[1:])
 
 
 if __name__ == "__main__":
diff --git a/scripts/run_buildozer.py b/scripts/run_buildozer.py
new file mode 100755
index 000000000000..d3e7b939b2c4
--- /dev/null
+++ b/scripts/run_buildozer.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+
+"""Runs buildozer on arguments.
+
+This is provided for other scripts to run buildozer without requiring it be
+manually installed.
+"""
+
+__copyright__ = """
+Part of the Carbon Language project, under the Apache License v2.0 with LLVM
+Exceptions. See /LICENSE for license information.
+SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+"""
+
+import os
+import sys
+
+import scripts_utils  # type: ignore
+
+
+def main() -> None:
+    buildozer = scripts_utils.get_release(scripts_utils.Release.BUILDOZER)
+    os.execv(buildozer, [buildozer] + sys.argv[1:])
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/scripts_utils.py b/scripts/scripts_utils.py
index f447e1468fcf..02cdf87f0693 100644
--- a/scripts/scripts_utils.py
+++ b/scripts/scripts_utils.py
@@ -158,10 +158,9 @@ def locate_bazel() -> str:
     if bazel:
         return bazel
 
-    if shutil.which("bazelisk"):
-        return "bazelisk"
-
-    if shutil.which("bazel"):
-        return "bazel"
+    for cmd in ("bazelisk", "bazel"):
+        target = shutil.which(cmd)
+        if target:
+            return target
 
     exit("Unable to run Bazel")