diff --git a/.github/actions/setup-bazel/action.yml b/.github/actions/setup-bazel/action.yml
index cfadbaa5ab..9b80820ed3 100644
--- a/.github/actions/setup-bazel/action.yml
+++ b/.github/actions/setup-bazel/action.yml
@@ -243,16 +243,21 @@ runs:
         fi
         python3 "$GITHUB_ACTION_PATH/configure_fleet.py"
 
-    - name: Stage hermetic launchers from the GitHub release API
-      id: linux-launchers
+    - name: Stage pinned Bazel inputs from the GitHub release API
+      id: release-distfiles
       env:
         GH_TOKEN: ${{ github.token }}
-      if: runner.environment == 'github-hosted' && runner.os == 'Linux' && runner.arch == 'X64'
+      if: runner.environment == 'github-hosted'
       shell: bash
       run: |
-        distdir=$(mktemp -d "$RUNNER_TEMP/hermetic-launcher.XXXXXXXX")
-        bash "$GITHUB_ACTION_PATH/stage_linux_launchers.sh" "$distdir"
-        printf 'bazelrc=common --distdir=%s\n' "$distdir" >> "$GITHUB_OUTPUT"
+        runner_temp=$RUNNER_TEMP
+        if [[ "$RUNNER_OS" == Windows ]]; then
+          # Git Bash and native Bazel both accept a drive-qualified slash path.
+          runner_temp=$(cygpath -m "$runner_temp")
+        fi
+        distdir=$(mktemp -d "$runner_temp/bazel-distfiles.XXXXXXXX")
+        bash "$GITHUB_ACTION_PATH/stage_release_distfiles.sh" "$distdir"
+        printf 'bazelrc=common --distdir="%s"\n' "$distdir" >> "$GITHUB_OUTPUT"
 
     - uses: bazel-contrib/setup-bazel@104e3eea9447cdaa4b00d0fb46191a3985d26ab3 # 0.19.1
       with:
@@ -262,7 +267,7 @@ runs:
         bazelrc: |
           common --repository_cache=${{ steps.disk-cache-config.outputs.repository-path }}
           build --disk_cache=${{ steps.fleet.outputs.enabled != 'true' && steps.disk-cache-config.outputs.path || '' }}
-          ${{ steps.linux-launchers.outputs.bazelrc }}
+          ${{ steps.release-distfiles.outputs.bazelrc }}
         cache-save: ${{ github.ref == 'refs/heads/master' && inputs.cache-save == 'true' }}
         # Windows build-script runfiles nest each vendored crate's sources
         # under its repository name twice; keep the output base short.
diff --git a/.github/actions/setup-bazel/stage_linux_launchers.sh b/.github/actions/setup-bazel/stage_release_distfiles.sh
similarity index 50%
rename from .github/actions/setup-bazel/stage_linux_launchers.sh
rename to .github/actions/setup-bazel/stage_release_distfiles.sh
index 2f06d044ac..6345564700 100644
--- a/.github/actions/setup-bazel/stage_linux_launchers.sh
+++ b/.github/actions/setup-bazel/stage_release_distfiles.sh
@@ -1,14 +1,12 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# These public API IDs identify the binaries-20261025 release used by
-# hermetic_launcher. Bazel checks its upstream SHA-256 before accepting a
-# distdir file and uses the original release URL when the file is absent.
+# Bazel accepts a staged file only when it matches the checksum in the
+# dependency rule or registry and otherwise tries the configured source.
 distdir=${1:?expected a runner-private distdir}
-api=https://api.github.com/repos/hermeticbuild/hermetic-launcher/releases/assets
 
 stage_asset() {
-  local id=$1 name=$2
+  local repo=$1 id=$2 name=$3
   # Hosted runners share unauthenticated API quotas. Read the job token only
   # for the fixed GitHub API origin. Curl drops Authorization on a redirect
   # to the release storage host, and the header stays off the command line.
@@ -18,10 +16,16 @@ stage_asset() {
   fi
   if ! curl --proto '=https' --proto-redir '=https' --header @- --fail --silent --show-error --location --remove-on-error \
       --connect-timeout 5 --max-time 30 --header 'Accept: application/octet-stream' \
-      --output "$distdir/$name" "$api/$id" <<< "$api_header"; then
+      --output "$distdir/$name" "https://api.github.com/repos/$repo/releases/assets/$id" <<< "$api_header"; then
     printf '::notice::Release API unavailable for %s; Bazel will use its configured source.\n' "$name"
   fi
 }
 
-stage_asset 674976726 finalize-stub-x86_64-linux
-stage_asset 674976728 runfiles-stub-x86_64-linux
+# The same rules_python archive is required by Bazel on every host.
+stage_asset bazel-contrib/rules_python 690529045 rules_python-2.4.6.tar.gz
+
+if [[ "$RUNNER_OS" == Linux && "$RUNNER_ARCH" == X64 ]]; then
+  # hermetic_launcher release binaries-20261025, for Linux x86-64 tools.
+  stage_asset hermeticbuild/hermetic-launcher 674976726 finalize-stub-x86_64-linux
+  stage_asset hermeticbuild/hermetic-launcher 674976728 runfiles-stub-x86_64-linux
+fi