diff --git a/kokoro/presubmit/kokoro_presubmit.sh b/kokoro/presubmit/kokoro_presubmit.sh
index 6fb85ba06..141ff04d1 100644
--- a/kokoro/presubmit/kokoro_presubmit.sh
+++ b/kokoro/presubmit/kokoro_presubmit.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2022 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/kokoro/presubmit/presubmit_main.sh b/kokoro/presubmit/presubmit_main.sh
index c07894328..0bf94f552 100644
--- a/kokoro/presubmit/presubmit_main.sh
+++ b/kokoro/presubmit/presubmit_main.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2023 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/mobile_install/apks.bzl b/mobile_install/apks.bzl
index 6e143f5e1..4f80c2612 100644
--- a/mobile_install/apks.bzl
+++ b/mobile_install/apks.bzl
@@ -33,6 +33,7 @@ def _compile_android_manifest(ctx, manifest, resources_zip, out_manifest):
     args.add("-force_debuggable", compilation_mode.get(ctx) != compilation_mode.OPT)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["manifest", args],
         tools = [ctx.executable._aapt2],
@@ -52,6 +53,7 @@ def _patch_split_manifests(ctx, orig_manifest, split_manifests, out_manifest_pac
     args.add("-pkg", out_manifest_package_name)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["patch", args],
         inputs = [orig_manifest],
@@ -79,6 +81,7 @@ def _make_split_apk(ctx, dirs, artifacts, debug_signing_keys, debug_signing_line
     args.add_joined("-dir", dir_paths.keys(), join_with = ",")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["repack", args],
         inputs = inputs,
diff --git a/mobile_install/deploy_info.bzl b/mobile_install/deploy_info.bzl
index e9127d47b..886c4cbab 100644
--- a/mobile_install/deploy_info.bzl
+++ b/mobile_install/deploy_info.bzl
@@ -42,6 +42,7 @@ def make_deploy_info_pb(ctx, manifest, apks):
     args.add("--deploy_info", deploy_info_pb)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._deploy_info,
         arguments = [args],
         outputs = [deploy_info_pb],
diff --git a/mobile_install/launcher_direct.bzl b/mobile_install/launcher_direct.bzl
index 68ee6ecf6..77ff28e66 100644
--- a/mobile_install/launcher_direct.bzl
+++ b/mobile_install/launcher_direct.bzl
@@ -21,7 +21,7 @@ load(":utils.bzl", "utils")
 
 visibility(PROJECT_VISIBILITY)
 
-_DEPLOY_SCRIPT = '''#!/bin/bash
+_DEPLOY_SCRIPT = '''#!/usr/bin/env bash
 set -e  # exit on failure
 umask 022  # set default file/dir creation mode to 755
 
diff --git a/mobile_install/native_libs.bzl b/mobile_install/native_libs.bzl
index f5610dee4..44356ff09 100644
--- a/mobile_install/native_libs.bzl
+++ b/mobile_install/native_libs.bzl
@@ -76,6 +76,7 @@ def make_native_libs_zip(ctx, native_libs, aar_native_libs, sibling, arch = None
     args.add("-out", native_zip)
     args.add("-architecture", arch)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["nativelib", args],
         inputs = depset(transitive = inputs),
diff --git a/mobile_install/r_java.bzl b/mobile_install/r_java.bzl
index 03c9d9646..857a6400e 100644
--- a/mobile_install/r_java.bzl
+++ b/mobile_install/r_java.bzl
@@ -13,8 +13,8 @@
 # limitations under the License.
 """Methods to create and process R.java."""
 
-load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
 load("@rules_java//java/common:java_common.bzl", "java_common")
+load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
 load(":utils.bzl", "utils")
 
 visibility(PROJECT_VISIBILITY)
@@ -83,6 +83,7 @@ def _make_r_jar(ctx, r_java, packages, out_r_jar):
 
     # Call action binary.
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = [rjar_args],
         tools = ctx.attr._jar_tool[DefaultInfo].files,
diff --git a/mobile_install/resources.bzl b/mobile_install/resources.bzl
index e0babcfb6..cac00e03c 100644
--- a/mobile_install/resources.bzl
+++ b/mobile_install/resources.bzl
@@ -154,6 +154,7 @@ def _bucketize_resources(ctx, data):
             args.add_joined("-res_paths", data[res_dir], join_with = ",")
 
         ctx.actions.run(
+            use_default_shell_env = True,
             executable = ctx.executable._android_kit,
             arguments = ["bucketize", args],
             inputs = data[res_dir],
@@ -191,6 +192,7 @@ def _compile_bucketized_resources(ctx, data):
                 sibling = res_bucket,
             )
             ctx.actions.run(
+                use_default_shell_env = True,
                 executable = ctx.executable._android_kit,
                 arguments = [
                     "compile",
@@ -241,6 +243,7 @@ def _compile_library_resouces(ctx, data):
             args.add("-in", res_dir)
             args.add("-out", out)
             ctx.actions.run(
+                use_default_shell_env = True,
                 executable = ctx.executable._android_kit,
                 arguments = ["compile", args],
                 inputs = data[res_type][res_dir] + ctx.attr._aapt2[DefaultInfo].files.to_list(),
@@ -290,6 +293,7 @@ def link_resources(
     args.add_joined("-asset_dirs", assets_dirs, join_with = ",")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["link", args],
         inputs = depset(
@@ -323,6 +327,7 @@ def liteparse(ctx):
     args.add("--out", r_pb)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["liteparse", args],
         inputs = ctx.rule.files.resource_files,
@@ -349,6 +354,7 @@ def compiletime_r_srcjar(ctx, output_srcjar, r_pbs, package):
     args.add_joined("-resourcePbs", r_pbs, join_with = ",")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["rstub", args],
         inputs = r_pbs,
diff --git a/mobile_install/utils.bzl b/mobile_install/utils.bzl
index 75a843e8e..4bd806a5c 100644
--- a/mobile_install/utils.bzl
+++ b/mobile_install/utils.bzl
@@ -13,10 +13,11 @@
 # limitations under the License.
 """Utilities for by the Mobile-Install aspect."""
 
+load("@rules_java//java/common:java_common.bzl", "java_common")
 load("//rules:min_sdk_version.bzl", _min_sdk_version = "min_sdk_version")
 load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
 load("//rules/flags:flags.bzl", "flags")
-load("@rules_java//java/common:java_common.bzl", "java_common")
+
 # Copybara: placeholder for GeneratedExtensionRegistryInfo load
 load("//tools/jdk:jvmopts.bzl", "BASE_JVMOPTS")
 load(":constants.bzl", "constants")
@@ -24,7 +25,7 @@ load(":constants.bzl", "constants")
 visibility(PROJECT_VISIBILITY)
 
 _PACKAGE_NAME_EXTRACTION_SCRIPT = """
-    #!/bin/bash
+    #!/usr/bin/env bash
     set -e  # exit on failure
     umask 022  # set default file/dir creation mode to 755
 
@@ -185,6 +186,7 @@ def dex(ctx, jar, out_dex_shards, deps = None):
     ]
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = java,
         tools = [ctx.executable._desugar_dex_sharding],
         arguments = jvm_flags + ["-jar", ctx.executable._desugar_dex_sharding.path, args],
@@ -273,7 +275,6 @@ def merge_dex_shards(
     """
     args = ctx.actions.args()
 
-
     args.add("--multidex", "best_effort")
     args.add("--output", out_dex_zip.path)
     args.add_all(dex_archives, before_each = "--input")
@@ -281,6 +282,7 @@ def merge_dex_shards(
     args.set_param_file_format("multiline")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._dexmerger,
         arguments = [args],
         tools = [],
@@ -307,6 +309,7 @@ def strip_r(ctx, jar, out_jar):
     args.add("-out", out_jar)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._android_kit,
         arguments = ["repack", args],
         inputs = [jar],
diff --git a/rules/aapt.bzl b/rules/aapt.bzl
index 9a1657a57..bb5346a1b 100644
--- a/rules/aapt.bzl
+++ b/rules/aapt.bzl
@@ -93,6 +93,7 @@ def _convert(
     args.add(input)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = aapt,
         arguments = [args],
         inputs = [input],
@@ -210,6 +211,7 @@ echo $(tac $1) > $2
     args.add("-o", out_resource_apk)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = aapt,
         arguments = [args],
         inputs = depset(
diff --git a/rules/aar_import/impl.bzl b/rules/aar_import/impl.bzl
index 527c5a587..d13bf99c4 100644
--- a/rules/aar_import/impl.bzl
+++ b/rules/aar_import/impl.bzl
@@ -13,6 +13,9 @@
 # limitations under the License.
 """Implementation."""
 
+load("@rules_java//java/common:java_common.bzl", "java_common")
+load("@rules_java//java/common:java_info.bzl", "JavaInfo")
+load("@rules_java//java/common:proguard_spec_info.bzl", "ProguardSpecInfo")
 load("//providers:providers.bzl", "AndroidLintRulesInfo", "AndroidNativeLibsInfo")
 load(
     "//rules:acls.bzl",
@@ -39,9 +42,6 @@ load(
     _utils = "utils",
 )
 load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
-load("@rules_java//java/common:java_common.bzl", "java_common")
-load("@rules_java//java/common:java_info.bzl", "JavaInfo")
-load("@rules_java//java/common:proguard_spec_info.bzl", "ProguardSpecInfo")
 
 visibility(PROJECT_VISIBILITY)
 
@@ -102,6 +102,7 @@ def _extract_resources(
     args.add("--output_res_dir", out_resources_dir.path)
     args.add("--output_assets_dir", out_assets_dir.path)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = aar_resources_extractor_tool,
         arguments = [args],
         inputs = [aar],
@@ -122,6 +123,7 @@ def _extract_native_libs(
     args.add("--cpu", cpu)
     args.add("--output_zip", output_zip)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = aar_native_libs_zip_creator_tool,
         arguments = [args],
         inputs = [aar],
@@ -195,6 +197,7 @@ def _extract_jars(
     args.add("--build_target", ctx.label)
     args.add("--output_singlejar_param_file", out_jars_params_file)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = aar_embedded_jars_extractor_tool,
         arguments = [args],
         inputs = [aar],
@@ -216,6 +219,7 @@ def _merge_jars(
     args.add("--normalize")
     args.add("@" + jars_param_file.path)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = single_jar_tool,
         arguments = [args],
         inputs = [jars_tree_artifact, jars_param_file],
@@ -388,6 +392,7 @@ def _validate_rule(
     args.add("-output", validation_output)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = checks,
         arguments = [args],
         inputs = [aar, manifest],
@@ -437,6 +442,7 @@ def _collect_proguard(
     args.add("--input_aar", aar)
     args.add("--output_proguard_file", out_proguard)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = aar_embedded_proguard_extractor,
         arguments = [args],
         inputs = [aar],
diff --git a/rules/android_application/android_application_rule.bzl b/rules/android_application/android_application_rule.bzl
index f96132caa..14aa476c9 100644
--- a/rules/android_application/android_application_rule.bzl
+++ b/rules/android_application/android_application_rule.bzl
@@ -13,6 +13,7 @@
 # limitations under the License.
 """android_application rule."""
 
+load("@rules_java//java/common:java_common.bzl", "java_common")
 load(
     "//providers:providers.bzl",
     "AndroidArchivedSandboxedSdkInfo",
@@ -60,7 +61,6 @@ load(
     _log = "log",
 )
 load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
-load("@rules_java//java/common:java_common.bzl", "java_common")
 load(":android_feature_module_rule.bzl", "get_feature_module_paths")
 load(":attrs.bzl", "ANDROID_APPLICATION_ATTRS")
 
@@ -203,6 +203,7 @@ def _create_feature_manifest(
         args.add(aapt2.executable)
 
         ctx.actions.run(
+            use_default_shell_env = True,
             executable = feature_manifest_script,
             inputs = [base_apk],
             outputs = [manifest],
@@ -232,6 +233,7 @@ def _create_feature_manifest(
     args.add(is_asset_pack)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = priority_feature_manifest_script,
         inputs = [base_apk, info.manifest],
         outputs = [priority_manifest],
@@ -252,6 +254,7 @@ def _create_feature_manifest(
     if is_asset_pack:
         args.add("--is_asset_pack")
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.attr._merge_manifests.files_to_run,
         inputs = [priority_manifest, info.manifest],
         outputs = [manifest],
diff --git a/rules/android_application/android_feature_module_rule.bzl b/rules/android_application/android_feature_module_rule.bzl
index 820716b3c..9dde8b88d 100644
--- a/rules/android_application/android_feature_module_rule.bzl
+++ b/rules/android_application/android_feature_module_rule.bzl
@@ -51,6 +51,7 @@ def _impl(ctx):
     args.add(ctx.attr.is_asset_pack)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = ctx.executable._feature_module_validation_script,
         inputs = inputs,
         outputs = [validation],
diff --git a/rules/android_application/bundle_deploy.sh_template b/rules/android_application/bundle_deploy.sh_template
index c941a463a..4528f5c1c 100644
--- a/rules/android_application/bundle_deploy.sh_template
+++ b/rules/android_application/bundle_deploy.sh_template
@@ -1,4 +1,4 @@
-#!/bin/bash --posix
+#!/usr/bin/env bash --posix
 
 java_executable="%java_executable%"
 bundletool="%bundletool_path%"
diff --git a/rules/android_application/feature_module_validation.sh b/rules/android_application/feature_module_validation.sh
index 4c5c67e90..0359ece5d 100644
--- a/rules/android_application/feature_module_validation.sh
+++ b/rules/android_application/feature_module_validation.sh
@@ -1,4 +1,4 @@
-#!/bin/bash --posix
+#!/usr/bin/env bash --posix
 # Copyright 2021 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/rules/android_application/gen_android_feature_manifest.sh b/rules/android_application/gen_android_feature_manifest.sh
index 5b5552e0e..4cc384a99 100644
--- a/rules/android_application/gen_android_feature_manifest.sh
+++ b/rules/android_application/gen_android_feature_manifest.sh
@@ -1,4 +1,4 @@
-#!/bin/bash --posix
+#!/usr/bin/env bash --posix
 # Copyright 2021 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/rules/android_application/gen_priority_android_feature_manifest.sh b/rules/android_application/gen_priority_android_feature_manifest.sh
index 066bfc783..e11f8839b 100644
--- a/rules/android_application/gen_priority_android_feature_manifest.sh
+++ b/rules/android_application/gen_priority_android_feature_manifest.sh
@@ -1,4 +1,4 @@
-#!/bin/bash --posix
+#!/usr/bin/env bash --posix
 # Copyright 2021 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/rules/android_binary/r8.bzl b/rules/android_binary/r8.bzl
index 973bc4d19..53c723db1 100644
--- a/rules/android_binary/r8.bzl
+++ b/rules/android_binary/r8.bzl
@@ -159,6 +159,7 @@ def process_resource_shrinking_r8(ctx, r8_ctx, packaged_resources_ctx, **_unused
     # 1. Convert the resource APK to proto format (resource shrinker operates on a proto apk)
     proto_resource_apk = ctx.actions.declare_file(ctx.label.name + "_proto_resource_apk.ap_")
     ctx.actions.run(
+        use_default_shell_env = True,
         arguments = [ctx.actions.args()
             .add("convert")
             .add(packaged_resources_ctx.resources_apk)  # input apk
@@ -192,6 +193,7 @@ def process_resource_shrinking_r8(ctx, r8_ctx, packaged_resources_ctx, **_unused
     # 3. Convert back to a binary APK
     resource_apk_shrunk = ctx.actions.declare_file(ctx.label.name + "_resource_apk_shrunk.ap_")
     ctx.actions.run(
+        use_default_shell_env = True,
         arguments = [ctx.actions.args()
             .add("convert")
             .add(proto_resource_apk_shrunk)  # input apk
diff --git a/rules/android_local_test/impl.bzl b/rules/android_local_test/impl.bzl
index 6a59a292c..0ae54b79f 100644
--- a/rules/android_local_test/impl.bzl
+++ b/rules/android_local_test/impl.bzl
@@ -13,6 +13,10 @@
 # limitations under the License.
 """Bazel rule for Android local test."""
 
+load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
+load("@rules_java//java/common:java_common.bzl", "java_common")
+load("@rules_java//java/common:java_info.bzl", "JavaInfo")
+load("@rules_java//java/common:java_plugin_info.bzl", "JavaPluginInfo")
 load("//providers:providers.bzl", "AndroidFilteredJdepsInfo")
 load("//rules:attrs.bzl", "attrs")
 load("//rules:common.bzl", "common")
@@ -34,10 +38,6 @@ load(
     "utils",
 )
 load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
-load("@rules_java//java/common:java_common.bzl", "java_common")
-load("@rules_java//java/common:java_info.bzl", "JavaInfo")
-load("@rules_java//java/common:java_plugin_info.bzl", "JavaPluginInfo")
-load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 
 visibility(PROJECT_VISIBILITY)
 
@@ -561,6 +561,7 @@ def filter_jdeps(ctx, in_jdeps, out_jdeps, filter_suffix):
     args.add("--out")
     args.add(out_jdeps.path)
     ctx.actions.run(
+        use_default_shell_env = True,
         inputs = [in_jdeps],
         outputs = [out_jdeps],
         executable = get_android_toolchain(ctx).jdeps_tool.files_to_run,
diff --git a/rules/android_sdk_repository/helper.bzl b/rules/android_sdk_repository/helper.bzl
index 86f57debf..5bf1397cb 100644
--- a/rules/android_sdk_repository/helper.bzl
+++ b/rules/android_sdk_repository/helper.bzl
@@ -368,7 +368,7 @@ def create_android_sdk_rules(
     native.genrule(
         name = "generate_fail_sh",
         outs = ["fail.sh"],
-        cmd = "echo -e '#!/bin/bash\\nexit 1' >> $@; chmod +x $@",
+        cmd = "echo -e '#!/usr/bin/env bash\\nexit 1' >> $@; chmod +x $@",
         executable = 1,
     )
 
@@ -390,7 +390,7 @@ def create_android_sdk_rules(
         outs = ["dx_binary.sh"],
         cmd = "\n".join([
             "cat > $@ <<'EOF'",
-            "#!/bin/bash",
+            "#!/usr/bin/env bash",
             "",
             "echo dx_binary should not be used anymore.",
             "exit 1",
@@ -405,7 +405,7 @@ def create_android_sdk_rules(
         outs = ["main_dex_list_creator.sh"],
         cmd = "\n".join([
             "cat > $@ <<'EOF'",
-            "#!/bin/bash",
+            "#!/usr/bin/env bash",
             "",
             "echo main_dex_list_creator should not be used anymore.",
             "exit 1",
diff --git a/rules/apk_packaging.bzl b/rules/apk_packaging.bzl
index 848109baf..e65839279 100644
--- a/rules/apk_packaging.bzl
+++ b/rules/apk_packaging.bzl
@@ -306,6 +306,7 @@ def _zipalign_apk(
     args.add(out_apk)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = zip_aligner,
         inputs = [in_apk],
         outputs = [out_apk],
@@ -377,6 +378,7 @@ def _sign_apk(
     args.add(in_apk)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = apk_signer,
         outputs = outputs,
         inputs = inputs,
@@ -400,6 +402,7 @@ def _create_deploy_info(
     args.add("--deploy_info", deploy_info)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = deploy_info_writer,
         arguments = [args],
         outputs = [deploy_info],
diff --git a/rules/baseline_profiles.bzl b/rules/baseline_profiles.bzl
index c6f0359e9..8959a57ab 100644
--- a/rules/baseline_profiles.bzl
+++ b/rules/baseline_profiles.bzl
@@ -209,6 +209,7 @@ def _expand_wildcards(
     args.add("--output", output)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = profgen,
         outputs = [output],
         inputs = [deploy_jar, profile],
diff --git a/rules/bundletool.bzl b/rules/bundletool.bzl
index 20562e091..4403bab88 100644
--- a/rules/bundletool.bzl
+++ b/rules/bundletool.bzl
@@ -13,13 +13,13 @@
 # limitations under the License.
 """Bazel Bundletool Commands."""
 
+load("@bazel_skylib//lib:paths.bzl", "paths")
+load("@rules_java//java/common:java_common.bzl", "java_common")
 load(
     "//rules:utils.bzl",
     "ANDROID_TOOLCHAIN_TYPE",
 )
 load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
-load("@rules_java//java/common:java_common.bzl", "java_common")
-load("@bazel_skylib//lib:paths.bzl", "paths")
 load(":common.bzl", _common = "common")
 load(":java.bzl", _java = "java")
 
@@ -258,6 +258,7 @@ def _build_sdk_module(
     args.add("--internal_apk_path", internal_apk)
     args.add("--output_module_path", out)
     ctx.actions.run(
+        use_default_shell_env = True,
         inputs = [internal_apk],
         outputs = [out],
         executable = bundletool_module_builder,
@@ -414,6 +415,7 @@ def _proto_apk_to_module(
 
     args.add("--output_module_path", out)
     ctx.actions.run(
+        use_default_shell_env = True,
         inputs = inputs,
         outputs = [out],
         executable = bundletool_module_builder,
diff --git a/rules/common.bzl b/rules/common.bzl
index ae7ef9115..c3222b75b 100644
--- a/rules/common.bzl
+++ b/rules/common.bzl
@@ -13,10 +13,10 @@
 # limitations under the License.
 """Bazel common library for the Android rules."""
 
-load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
-load("//rules/android_common:reexport_android_common.bzl", _native_android_common = "native_android_common")
 load("@rules_java//java/common:java_common.bzl", "java_common")
 load("@rules_java//java/common:java_info.bzl", "JavaInfo")
+load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
+load("//rules/android_common:reexport_android_common.bzl", _native_android_common = "native_android_common")
 load(":utils.bzl", "ANDROID_TOOLCHAIN_TYPE", "get_android_toolchain", _log = "log")
 
 visibility(PROJECT_VISIBILITY)
@@ -54,6 +54,7 @@ def _filter_zip_include(ctx, in_zip, out_zip, filters = []):
     args.add("--out")
     args.add(out_zip.path)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = get_android_toolchain(ctx).zip_tool.files_to_run,
         arguments = [args],
         inputs = [in_zip],
@@ -107,6 +108,7 @@ def _filter_zip_exclude(
     args.add("--outputMode", compression_mode)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = get_android_toolchain(ctx).zip_filter.files_to_run,
         arguments = [args],
         inputs = [input] + filter_zips,
diff --git a/rules/data_binding.bzl b/rules/data_binding.bzl
index 9039cba35..3b1ba487e 100644
--- a/rules/data_binding.bzl
+++ b/rules/data_binding.bzl
@@ -87,6 +87,7 @@ def _gen_sources(ctx, output_dir, java_package, deps, layout_info, data_binding_
     args.add_all(class_infos, before_each = "-dependencyClassInfoList")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = data_binding_exec,
         arguments = ["GEN_BASE_CLASSES", args],
         inputs = inputs,
diff --git a/rules/dex.bzl b/rules/dex.bzl
index c570af383..080e5a927 100644
--- a/rules/dex.bzl
+++ b/rules/dex.bzl
@@ -13,13 +13,13 @@
 # limitations under the License.
 """Bazel Dex Commands."""
 
+load("@bazel_skylib//lib:collections.bzl", "collections")
 load("//providers:providers.bzl", "StarlarkAndroidDexInfo")
 load("//rules:acls.bzl", "acls")
 load("//rules:attrs.bzl", _attrs = "attrs")
 load("//rules:common.bzl", _common = "common")
 load("//rules:java.bzl", _java = "java")
 load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
-load("@bazel_skylib//lib:collections.bzl", "collections")
 load(":utils.bzl", "ANDROID_TOOLCHAIN_TYPE", "get_android_toolchain", "utils")
 
 visibility(PROJECT_VISIBILITY)
@@ -444,6 +444,7 @@ def _dex(
             execution_requirements["supports-multiplex-workers"] = "1"
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = dex_exec,
         arguments = [args],
         inputs = [input],
@@ -502,6 +503,7 @@ def _optimizing_dex(
         args.add("--lib", library_jar)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = dex_exec,
         arguments = [args],
         inputs = inputs,
@@ -561,6 +563,7 @@ def _get_java8_legacy_dex_and_map(ctx, build_customized_files = False, binary_ja
             args.add("--min-api", min_sdk_version)
 
         ctx.actions.run(
+            use_default_shell_env = True,
             executable = get_android_toolchain(ctx).build_java8_legacy_dex.files_to_run,
             inputs = [binary_jar, bootclasspath_jar],
             outputs = [java8_legacy_dex_rules, java8_legacy_dex_map, java8_legacy_dex],
@@ -595,6 +598,7 @@ def _dex_merge(
         args.add("--main-dex-list", main_dex_list)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = dexmerger,
         arguments = [args],
         inputs = inputs,
@@ -685,6 +689,7 @@ def _optimized_dex_merge(
     args.add("@" + param_file.path)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = optimizing_dexer,
         arguments = [args],
         inputs = inputs,
@@ -754,6 +759,7 @@ def _generate_main_dex_list(
     args.add_all(proguard_specs, before_each = "--main-dex-rules")
     args.add(jar)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = legacy_main_dex_list_generator,
         arguments = [args],
         outputs = [main_dex_list],
@@ -780,6 +786,7 @@ def _transform_dex_list_through_proguard_map(
     args.add("--output", obfuscated_main_dex_list)
     args.add("--obfuscation_map", proguard_output_map)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = dex_list_obfuscator,
         arguments = [args],
         outputs = [obfuscated_main_dex_list],
diff --git a/rules/idl.bzl b/rules/idl.bzl
index e22b2dc65..e5c00a57b 100644
--- a/rules/idl.bzl
+++ b/rules/idl.bzl
@@ -74,6 +74,7 @@ def _gen_java_from_idl(
     aidl_lib_files = [aidl_lib[DefaultInfo].files] if aidl_lib and not uses_aosp_compiler else []
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = aidl,
         arguments = [args],
         inputs = depset(
diff --git a/rules/java.bzl b/rules/java.bzl
index fa749dad7..dddfb25da 100644
--- a/rules/java.bzl
+++ b/rules/java.bzl
@@ -13,9 +13,9 @@
 # limitations under the License.
 """Bazel Java APIs for the Android rules."""
 
-load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
 load("@rules_java//java/common:java_common.bzl", "java_common")
 load("@rules_java//java/private:android_support.bzl", "android_support")  # buildifier: disable=bzl-visibility
+load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
 load(":path.bzl", _path = "path")
 load(":utils.bzl", "log")
 
@@ -421,6 +421,7 @@ def _singlejar(
     args.use_param_file("@%s")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = java_toolchain[java_common.JavaToolchainInfo].single_jar,
         toolchain = "@bazel_tools//tools/jdk:toolchain_type",
         arguments = [args],
@@ -450,7 +451,7 @@ def _run(
       supports_workers: This action is worker-compatible (enabled with --strategy=MyAction=worker).
       supports_multiplex_workers: This action is multiplex worker-compatible.
       execution_requirements: Information to schedule the action, in key-value pairs.
-      **args: Additional arguments to pass to ctx.actions.run(). Some will get modified.
+      **args: Additional arguments to pass to ctx.actions.run(use_default_shell_env = True,). Some will get modified.
     """
 
     if type(ctx) != "ctx":
@@ -495,7 +496,7 @@ def _run(
         if supports_multiplex_workers:
             execution_requirements["supports-multiplex-workers"] = "1"
 
-    ctx.actions.run(execution_requirements = execution_requirements, mnemonic = mnemonic, **args)
+    ctx.actions.run(use_default_shell_env = True, execution_requirements = execution_requirements, mnemonic = mnemonic, **args)
 
 def _create_deploy_jar(
         ctx,
@@ -571,6 +572,7 @@ def _check_one_version(
     )
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = tool,
         arguments = [args],
         outputs = [output],
diff --git a/rules/proguard.bzl b/rules/proguard.bzl
index d22e68369..9b4a3e3d7 100644
--- a/rules/proguard.bzl
+++ b/rules/proguard.bzl
@@ -13,9 +13,9 @@
 # limitations under the License.
 """Bazel Android Proguard library for the Android rules."""
 
-load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
 load("@rules_java//java/common:java_common.bzl", "java_common")
 load("@rules_java//java/common:proguard_spec_info.bzl", "ProguardSpecInfo")
+load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
 load(":acls.bzl", "acls")
 load(":android_neverlink_aspect.bzl", "StarlarkAndroidNeverlinkInfo")
 load(":baseline_profiles.bzl", _baseline_profiles = "baseline_profiles")
@@ -45,6 +45,7 @@ def _validate_proguard_spec(
     args.add("--output", out_validated_proguard_spec)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = proguard_allowlister,
         arguments = [args],
         inputs = [proguard_spec],
@@ -163,6 +164,7 @@ def _generate_min_sdk_version_assumevalues(
     outputs.append(output)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         inputs = inputs,
         outputs = outputs,
         executable = generate_exec,
@@ -328,6 +330,7 @@ def _optimization_action(
         outputs.append(next_stage_output)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         outputs = outputs,
         inputs = inputs,
         executable = proguard_tool,
diff --git a/rules/resources.bzl b/rules/resources.bzl
index e82c640fc..faf9573ad 100644
--- a/rules/resources.bzl
+++ b/rules/resources.bzl
@@ -13,13 +13,13 @@
 # limitations under the License.
 """Bazel Android Resources."""
 
+load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
+load("@rules_java//java/common:java_common.bzl", "java_common")
+load("@rules_java//java/common:java_info.bzl", "JavaInfo")
 load("//providers:providers.bzl", "AndroidLibraryResourceClassJarProvider", "ResourcesNodeInfo", "StarlarkAndroidResourcesInfo")
 load("//rules:acls.bzl", "acls")
 load("//rules:min_sdk_version.bzl", _min_sdk_version = "min_sdk_version")
 load("//rules:visibility.bzl", "PROJECT_VISIBILITY")
-load("@rules_java//java/common:java_common.bzl", "java_common")
-load("@rules_java//java/common:java_info.bzl", "JavaInfo")
-load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 load(":attrs.bzl", _attrs = "attrs")
 load(":busybox.bzl", _busybox = "busybox")
 load(":path.bzl", _path = "path")
@@ -225,6 +225,7 @@ def _add_g3itr(
     args.add(manifest)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = xsltproc,
         arguments = [args],
         inputs = [manifest, instrument_xslt],
@@ -301,6 +302,7 @@ echo "$SORTED" >> $3
     args.add(manifest_params, format = "--flagfile=%s")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = legacy_merger,
         arguments = [args],
         inputs = depset([manifest, manifest_params], transitive = [mergee_manifests]),
@@ -369,7 +371,7 @@ def _fix_databinding_compiled_resources(
         arguments = [compiled_resources.path, out_compiled_resources.path, zip_tool.executable.path],
         toolchain = None,
         mnemonic = "FixDatabindingCompiledResources",
-        command = """#!/bin/bash
+        command = """#!/usr/bin/env bash
 set -e
 
 IN_DIR=$(mktemp -d)
@@ -867,6 +869,7 @@ def _liteparse(ctx, out_r_pb, resource_files, android_kit):
     args.add("--out", out_r_pb)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = android_kit,
         arguments = ["liteparse", args],
         inputs = resource_files,
@@ -904,6 +907,7 @@ def _fastr(ctx, r_pbs, package, manifest, android_kit):
     args.add_joined("-resourcePbs", r_pbs, join_with = ",")
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = android_kit,
         arguments = ["rstub", args],
         inputs = inputs,
@@ -1081,6 +1085,7 @@ def _bump_min_sdk(
     )
     args.add("-output", out_manifest.path)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = get_android_toolchain(ctx).android_kit.files_to_run,
         inputs = [manifest],
         outputs = [out_manifest, log],
@@ -1129,6 +1134,7 @@ def _set_default_min_sdk(
     )
     args.add("-output", out_manifest.path)
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = get_android_toolchain(ctx).android_kit.files_to_run,
         inputs = [manifest],
         outputs = [out_manifest, log],
@@ -1169,6 +1175,7 @@ def _validate_manifest(
     args.add("--expected_min_sdk_version", min_sdk_version)
 
     ctx.actions.run(
+        use_default_shell_env = True,
         executable = manifest_validation_tool,
         arguments = [args],
         outputs = [output],
diff --git a/rules/utils.bzl b/rules/utils.bzl
index d0f5b555d..b1e45b3f7 100644
--- a/rules/utils.bzl
+++ b/rules/utils.bzl
@@ -401,7 +401,7 @@ def _run_validation(
         )
 
     ctx.actions.run_shell(
-        command = """#!/bin/bash
+        command = """#!/usr/bin/env bash
 set -eu
 set -o pipefail # Returns the executables failure code, if it fails.
 
diff --git a/src/tools/extract_desugar_pgcfg_flags/extract_desugar_pgcfg_flags_test.sh b/src/tools/extract_desugar_pgcfg_flags/extract_desugar_pgcfg_flags_test.sh
index 3415dd128..109ab0429 100755
--- a/src/tools/extract_desugar_pgcfg_flags/extract_desugar_pgcfg_flags_test.sh
+++ b/src/tools/extract_desugar_pgcfg_flags/extract_desugar_pgcfg_flags_test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2023 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/src/tools/jdeps/jdeps_test.sh b/src/tools/jdeps/jdeps_test.sh
index 73d149ca0..da5638a10 100755
--- a/src/tools/jdeps/jdeps_test.sh
+++ b/src/tools/jdeps/jdeps_test.sh
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # template generated by genshtest
 
diff --git a/src/validations/aar_import_checks/BUILD b/src/validations/aar_import_checks/BUILD
index 10086f05d..b481a296b 100644
--- a/src/validations/aar_import_checks/BUILD
+++ b/src/validations/aar_import_checks/BUILD
@@ -9,7 +9,7 @@ genrule(
     outs = ["aar_import_checks.sh"],
     cmd = """
 cat > $@ <<"EOF"
-#!/bin/bash
+#!/usr/bin/env bash
 while [[ $$# -gt 0 ]]
 do
   case $$1 in
@@ -60,4 +60,4 @@ alias(
         ":windows": "aar_import_checks.bat",
         "//conditions:default": "aar_import_checks.sh",
     }),
-)
\ No newline at end of file
+)
diff --git a/test/bashunit/unittest.bash b/test/bashunit/unittest.bash
index c88ba2ceb..fcc9d548c 100644
--- a/test/bashunit/unittest.bash
+++ b/test/bashunit/unittest.bash
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Copyright 2015 The Bazel Authors. All rights reserved.
 #
@@ -21,7 +21,7 @@
 # A typical test suite looks like so:
 #
 #   ------------------------------------------------------------------------
-#   #!/bin/bash
+#   #!/usr/bin/env bash
 #
 #   source path/to/unittest.bash || exit 1
 #
diff --git a/test/bashunit/unittest_test.py b/test/bashunit/unittest_test.py
index 374e5188b..52993ee4b 100644
--- a/test/bashunit/unittest_test.py
+++ b/test/bashunit/unittest_test.py
@@ -33,7 +33,7 @@
 # For now, we still need to reference the "old" runfiles.bash path in the
 # bashunit library.
 _TEST_PREAMBLE = """
-#!/bin/bash
+#!/usr/bin/env bash
 # --- begin runfiles.bash initialization ---
 if [[ -f "${RUNFILES_DIR:-/dev/null}/bazel_tools/tools/bash/runfiles/runfiles.bash" ]]; then
   source "${RUNFILES_DIR}/bazel_tools/tools/bash/runfiles/runfiles.bash"
diff --git a/test/rules/android_local_test/integration_test_stub_script.sh b/test/rules/android_local_test/integration_test_stub_script.sh
index 9aa11ff7c..050cc48c0 100644
--- a/test/rules/android_local_test/integration_test_stub_script.sh
+++ b/test/rules/android_local_test/integration_test_stub_script.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2021 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/test/rules/android_sdk_repository/android_helper.sh b/test/rules/android_sdk_repository/android_helper.sh
index 62320f58e..7da0109bf 100644
--- a/test/rules/android_sdk_repository/android_helper.sh
+++ b/test/rules/android_sdk_repository/android_helper.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Copyright 2023 The Bazel Authors. All rights reserved.
 #
diff --git a/test/rules/android_sdk_repository/android_sdk_repository_test.sh b/test/rules/android_sdk_repository/android_sdk_repository_test.sh
index f732ff5e9..4ad253a6b 100755
--- a/test/rules/android_sdk_repository/android_sdk_repository_test.sh
+++ b/test/rules/android_sdk_repository/android_sdk_repository_test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # Copyright 2023 The Bazel Authors. All rights reserved.
 #
diff --git a/test/rules/resources/BUILD b/test/rules/resources/BUILD
index df9e1aa2e..25205f3e0 100644
--- a/test/rules/resources/BUILD
+++ b/test/rules/resources/BUILD
@@ -1043,7 +1043,7 @@ genrule(
     name = "generated_resources",
     srcs = ["databinding_res/res/layout/category.xml"],
     outs = ["gen_databinding_res/res/layout/category.xml"],
-    cmd = """#!/bin/bash
+    cmd = """#!/usr/bin/env bash
 cp $< $@
 """,
 )
diff --git a/test/rules/resources/test.bzl b/test/rules/resources/test.bzl
index 1cabb2ea4..2324f622e 100644
--- a/test/rules/resources/test.bzl
+++ b/test/rules/resources/test.bzl
@@ -13,6 +13,14 @@
 # limitations under the License.
 """Test rule for resource processing."""
 
+load(
+    "@bazel_skylib//lib:unittest.bzl",
+    "analysistest",
+    "asserts",
+    "unittest",
+)
+load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
+load("@rules_java//java/common:java_common.bzl", "java_common")
 load("//providers:providers.bzl", "StarlarkAndroidResourcesInfo")
 load("//rules:attrs.bzl", "ANDROID_BINARY_ATTRS")
 load("//rules:common.bzl", _common = "common")
@@ -31,14 +39,6 @@ load(
     "//test/utils:asserts.bzl",
     _asserts = "asserts",
 )
-load("@rules_java//java/common:java_common.bzl", "java_common")
-load(
-    "@bazel_skylib//lib:unittest.bzl",
-    "analysistest",
-    "asserts",
-    "unittest",
-)
-load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 
 visibility(PROJECT_VISIBILITY)
 
@@ -186,7 +186,7 @@ def _starlark_process_test_impl(ctx):
     test = ctx.actions.declare_file(ctx.label.name + "/test.sh")
     ctx.actions.write(
         test,
-        """#!/bin/bash
+        """#!/usr/bin/env bash
 set -eu
 
 EXPECTED_R_CLASS_FIELDS="{expected_r_class_fields}"
@@ -400,7 +400,7 @@ def _resources_package_test_impl(ctx):
     test = ctx.actions.declare_file(ctx.label.name + "/test.sh")
     ctx.actions.write(
         test,
-        """#!/bin/bash
+        """#!/usr/bin/env bash
 set -eu
 
 MANIFEST={manifest}
diff --git a/test/rules/resources/test_stub_script.sh b/test/rules/resources/test_stub_script.sh
index 8d4c906b5..c34b7a454 100644
--- a/test/rules/resources/test_stub_script.sh
+++ b/test/rules/resources/test_stub_script.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2018 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/test/utils/integration_demo/demo_test.sh b/test/utils/integration_demo/demo_test.sh
index e47690c55..3e1fa27fc 100755
--- a/test/utils/integration_demo/demo_test.sh
+++ b/test/utils/integration_demo/demo_test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2023 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/toolchains/android/zip.sh b/toolchains/android/zip.sh
index 5d0f18b51..f2bb72d2a 100755
--- a/toolchains/android/zip.sh
+++ b/toolchains/android/zip.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2020 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tools/android/build_java8_legacy_dex.sh b/tools/android/build_java8_legacy_dex.sh
index 6d4bcc264..e1fe544ea 100755
--- a/tools/android/build_java8_legacy_dex.sh
+++ b/tools/android/build_java8_legacy_dex.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2024 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tools/android/d8_desugar.sh b/tools/android/d8_desugar.sh
index 5b0b6db5d..0d2dda1ba 100755
--- a/tools/android/d8_desugar.sh
+++ b/tools/android/d8_desugar.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2024 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tools/android/dex_list_obfuscator.sh b/tools/android/dex_list_obfuscator.sh
index b2620abab..e47f1d005 100755
--- a/tools/android/dex_list_obfuscator.sh
+++ b/tools/android/dex_list_obfuscator.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2018 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tools/android/xslt/xslt.sh b/tools/android/xslt/xslt.sh
index fef623550..2cf323985 100755
--- a/tools/android/xslt/xslt.sh
+++ b/tools/android/xslt/xslt.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2020 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tools/jdk/BUILD b/tools/jdk/BUILD
index 73ed30141..82747e44c 100644
--- a/tools/jdk/BUILD
+++ b/tools/jdk/BUILD
@@ -40,7 +40,7 @@ sh_binary(
     name = "create_system",
     srcs = ["create_system.sh"],
     # Required on Windows to avoid "LAUNCHER ERROR: Rlocation failed", because providing it via
-    # the "tools" parameter of ctx.actions.run() doesn't seem to be enough.
+    # the "tools" parameter of ctx.actions.run(use_default_shell_env = True,) doesn't seem to be enough.
     data = ["//tools/android:unzip"],
     visibility = ["//visibility:public"],
 )
diff --git a/tools/jdk/create_system.sh b/tools/jdk/create_system.sh
index 3b38c2135..42bfc8c18 100755
--- a/tools/jdk/create_system.sh
+++ b/tools/jdk/create_system.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2024 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tools/jdk/jar_to_module_info_test.sh b/tools/jdk/jar_to_module_info_test.sh
index dbce1fb11..24b8dd327 100755
--- a/tools/jdk/jar_to_module_info_test.sh
+++ b/tools/jdk/jar_to_module_info_test.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2024 The Bazel Authors. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/tools/jdk/system.bzl b/tools/jdk/system.bzl
index f2ad0eb85..c5a366f03 100644
--- a/tools/jdk/system.bzl
+++ b/tools/jdk/system.bzl
@@ -32,6 +32,7 @@ def _ijar(ctx, input, output):
     args.add("--target_label", ctx.label)
     ijar_bin = ctx.attr._java_toolchain[java_common.JavaToolchainInfo].ijar
     ctx.actions.run(
+        use_default_shell_env = True,
         inputs = [input],
         outputs = [output],
         executable = ijar_bin,
@@ -65,6 +66,7 @@ def _android_system(ctx):
     args.add("--output_auxiliary_jar", auxiliary_jar)
     args.add_joined("--exclusions", ctx.attr.exclusions, join_with = ",")
     ctx.actions.run(
+        use_default_shell_env = True,
         mnemonic = "SplitCoreJar",
         inputs = [merged_interface_jar] + core_jars,
         outputs = [core_jar, auxiliary_jar],
@@ -77,6 +79,7 @@ def _android_system(ctx):
     args.add("--input", core_jar)
     args.add("--output", module_info)
     ctx.actions.run(
+        use_default_shell_env = True,
         mnemonic = "JarToModuleInfo",
         inputs = [core_jar],
         outputs = [module_info],
@@ -93,6 +96,7 @@ def _android_system(ctx):
     args.add("--java_home", java_runtime.java_home)
     args.add("--module_info", module_info)
     ctx.actions.run(
+        use_default_shell_env = True,
         inputs = depset(
             [
                 core_jar,