diff --git a/WORKSPACE b/WORKSPACE
index 5a5b96d0e14..c1bbf626b62 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -106,9 +106,9 @@ http_archive(
 # Container rules
 http_archive(
     name = "rules_oci",
-    sha256 = "02df4efc5c7431904a927c1947fc7b6e2eda838b038b15bdf9a15918e7d6c04b",
-    strip_prefix = "rules_oci-2.0.0-alpha4",
-    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.0.0-alpha4/rules_oci-v2.0.0-alpha4.tar.gz",
+    sha256 = "647f4c6fd092dc7a86a7f79892d4b1b7f1de288bdb4829ca38f74fd430fcd2fe",
+    strip_prefix = "rules_oci-1.7.6",
+    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.7.6/rules_oci-v1.7.6.tar.gz",
 )
 
 http_archive(
@@ -399,9 +399,15 @@ load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
 
 rules_oci_dependencies()
 
-load("@rules_oci//oci:repositories.bzl", "oci_register_toolchains")
+load("@rules_oci//oci:repositories.bzl", "LATEST_CRANE_VERSION", "oci_register_toolchains")
 
-oci_register_toolchains(name = "oci")
+oci_register_toolchains(
+    name = "oci",
+    crane_version = LATEST_CRANE_VERSION,
+    # Uncommenting the zot toolchain will cause it to be used instead of crane for some tasks.
+    # Note that it does not support docker-format images.
+    # zot_version = LATEST_ZOT_VERSION,
+)
 
 # Optional, for oci_tarball rule
 load("@rules_pkg//:deps.bzl", "rules_pkg_dependencies")
diff --git a/doc/dev/background-information/bazel/containers.md b/doc/dev/background-information/bazel/containers.md
index 262d7bd6e3d..c74d4580168 100644
--- a/doc/dev/background-information/bazel/containers.md
+++ b/doc/dev/background-information/bazel/containers.md
@@ -154,8 +154,11 @@ We can now build this image _locally_ and run those tests as well.
 Example:
 
 ```
-# Create and load a tarball that can be loaded in Docker of the worker service:
-bazel run //cmd/worker:image_tarball
+# Create a tarball that can be loaded in Docker of the worker service:
+bazel build //cmd/worker:image_tarball
+
+# Load the image in Docker:
+docker load --input $(bazel cquery //cmd/worker:image_tarball  --output=files)
 
 # Run the container structure tests
 bazel test //cmd/worker:image_test
diff --git a/doc/dev/background-information/bazel/faq.md b/doc/dev/background-information/bazel/faq.md
index 75fe7450631..bb94a1aafa0 100644
--- a/doc/dev/background-information/bazel/faq.md
+++ b/doc/dev/background-information/bazel/faq.md
@@ -55,8 +55,11 @@ Our containers are only built for `linux/amd64`, therefore we need to cross-comp
 Example:
 
 ```
-# Create and load a tarball that can be loaded in Docker of the worker service:
-bazel run //cmd/worker:image_tarball
+# Create a tarball that can be loaded in Docker of the worker service:
+bazel build //cmd/worker:image_tarball
+
+# Load the image in Docker:
+docker load --input $(bazel cquery //cmd/worker:image_tarball  --output=files)
 ```
 
 You can also use the same configuration flag to run the container tests on MacOS:
diff --git a/doc/dev/background-information/sg/index.md b/doc/dev/background-information/sg/index.md
index a6d39c88f3c..5b5b23d3424 100644
--- a/doc/dev/background-information/sg/index.md
+++ b/doc/dev/background-information/sg/index.md
@@ -186,7 +186,8 @@ env:
 commands:
   gitserver:
     install: |
-      bazel run //cmd/gitserver:image_tarball
+      bazel build //cmd/gitserver:image_tarball && \
+      docker load --input $(bazel cquery //cmd/gitserver:image_tarball --output=files)
   gitserver-0:
     cmd: |
       docker inspect gitserver-${GITSERVER_INDEX} >/dev/null 2>&1 && docker stop gitserver-${GITSERVER_INDEX}
diff --git a/docker-images/syntax-highlighter/crates/scip-syntax/BUILD.bazel b/docker-images/syntax-highlighter/crates/scip-syntax/BUILD.bazel
index fee02782d79..d8fc746b409 100644
--- a/docker-images/syntax-highlighter/crates/scip-syntax/BUILD.bazel
+++ b/docker-images/syntax-highlighter/crates/scip-syntax/BUILD.bazel
@@ -106,31 +106,22 @@ oci_image(
     base = "@scip-java",
 )
 
-# TODO: this is expensive as whole has to be uploaded to the remote cache
-# Instead call the executable script created by oci_tarball to load the image
-# to daemon.
 oci_tarball(
     name = "scip_java_image_tarball",
     image = ":scip_java_image",
     repo_tags = ["scip-java:tmp"],
 )
 
-filegroup(
-    name = "scip_java_image_tarball_tar",
-    srcs = [":scip_java_image_tarball"],
-    output_group = "tarball",
-)
-
 genrule(
     name = "java_groundtruth_scip",
     srcs = [
         "testdata/scip-index.sh",
-        ":scip_java_image_tarball_tar",
+        ":scip_java_image_tarball",
     ] + glob(["testdata/java/**"]),
     outs = ["index-java.scip"],
     cmd = """\
     $(location testdata/scip-index.sh) \
-        $(location :scip_java_image_tarball_tar) \
+        $(location :scip_java_image_tarball) \
         scip-java:tmp \
         $(location testdata/java/build.gradle) \
         'scip-java index' \
diff --git a/sg.config.yaml b/sg.config.yaml
index ad2a9be8952..68ef31f15fb 100644
--- a/sg.config.yaml
+++ b/sg.config.yaml
@@ -773,7 +773,8 @@ commands:
     # Nothing to run for this, we just want to re-run the install script every time.
     cmd: exit 0
     install: |
-      bazel run //cmd/batcheshelper:image_tarball
+      bazel build //cmd/batcheshelper:image_tarball
+      docker load --input $(bazel cquery //cmd/batcheshelper:image_tarball --output=files)
     env:
       IMAGE: batcheshelper:candidate
       # TODO: This is required but should only be set on M1 Macs.
@@ -864,7 +865,8 @@ commands:
       mkdir -p "${GRAFANA_DISK}"
       mkdir -p "$(dirname ${GRAFANA_LOG_FILE})"
       docker inspect $CONTAINER >/dev/null 2>&1 && docker rm -f $CONTAINER
-      bazel run //docker-images/grafana:image_tarball
+      bazel build //docker-images/grafana:image_tarball
+      docker load --input $(bazel cquery //docker-images/grafana:image_tarball --output=files)
     env:
       GRAFANA_DISK: $HOME/.sourcegraph-dev/data/grafana
       # Log file location: since we log outside of the Docker container, we should
@@ -921,7 +923,8 @@ commands:
 
       cp ${PROM_TARGETS} "${CONFIG_DIR}"/prometheus_targets.yml
 
-      bazel run //docker-images/prometheus:image_tarball
+      bazel build //docker-images/prometheus:image_tarball
+      docker load --input $(bazel cquery //docker-images/prometheus:image_tarball --output=files)
     env:
       PROMETHEUS_DISK: $HOME/.sourcegraph-dev/data/prometheus
       # See comment above for `grafana`
@@ -977,7 +980,8 @@ commands:
         "${IMAGE}"
     install: |
       docker inspect $CONTAINER >/dev/null 2>&1 && docker rm -f $CONTAINER
-      bazel run //docker-images/postgres_exporter:image_tarball
+      bazel build //docker-images/postgres_exporter:image_tarball
+      docker load --input $(bazel cquery //docker-images/postgres_exporter:image_tarball --output=files)
     env:
       IMAGE: postgres-exporter:candidate
       CONTAINER: postgres_exporter
@@ -991,7 +995,8 @@ commands:
 
   otel-collector:
     install: |
-      bazel run //docker-images/opentelemetry-collector:image_tarball
+      bazel build //docker-images/opentelemetry-collector:image_tarball
+      docker load --input $(bazel cquery //docker-images/opentelemetry-collector:image_tarball --output=files)
     description: OpenTelemetry collector
     cmd: |
       JAEGER_HOST='host.docker.internal'