diff --git a/.bazelci/build_bazel_binaries.yml b/.bazelci/build_bazel_binaries.yml
index 38aaa3e77822ee..0fba1b7a810d9d 100644
--- a/.bazelci/build_bazel_binaries.yml
+++ b/.bazelci/build_bazel_binaries.yml
@@ -31,7 +31,10 @@ platforms:
     build_flags:
       - "-c"
       - "opt"
-  ubuntu2204:
+      # https://github.com/bazelbuild/continuous-integration/issues/2353
+      - "--linkopt=-Wl,--no-fix-cortex-a53-843419"
+      - "--host_linkopt=-Wl,--no-fix-cortex-a53-843419"
+  ubuntu2404:
     build_targets:
       - "//src:bazel"
       - "//src:bazel_nojdk"
diff --git a/.bazelci/postsubmit.yml b/.bazelci/postsubmit.yml
index 84fa4f52dfe174..08b60d14443364 100644
--- a/.bazelci/postsubmit.yml
+++ b/.bazelci/postsubmit.yml
@@ -56,7 +56,7 @@ tasks:
     include_json_profile:
       - build
       - test
-  ubuntu2204:
+  ubuntu2404:
     shell_commands:
       - rm -rf $HOME/bazeltest
       - mkdir $HOME/bazeltest
@@ -282,8 +282,8 @@ tasks:
       - "//src:bazel_nojdk.exe"
     include_json_profile:
       - build
-  rbe_ubuntu2004:
-    platform: ubuntu2004
+  rbe_ubuntu2404:
+    platform: ubuntu2404
     name: "RBE"
     build_flags:
       - "--config=remote"
@@ -336,6 +336,14 @@ tasks:
       - "-//src/test/shell/bazel:verify_workspace"
       # Disable some Android tests since we are moving Android rules out of the Bazel repo.
       - "-//src/test/shell/bazel:bazel_android_tools_test"
+      # Disable tests that fail on RBE due to sandboxing/mount restrictions
+      - "-//src/test/shell/integration:sandboxing_test"
+      - "-//src/test/java/com/google/devtools/build/lib/shell:CommandUsingLinuxSandboxTest"
+      - "-//src/test/shell/bazel:bazel_spawnstats_test"
+      - "-//src/test/shell/integration:bazel_hardened_sandboxed_worker_test"
+      - "-//src/test/shell/integration:test_test"
+      - "-//src/test/tools:daemonize_test"
+      - "-//src/test/tools:linux-sandbox_test"
     include_json_profile:
       - build
       - test
diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 2a48f265ccbbb5..51b518419f2037 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -75,7 +75,7 @@ tasks:
     include_json_profile:
       - build
       - test
-  ubuntu2204:
+  ubuntu2404:
     shards: 4
     shell_commands:
       - rm -rf $HOME/bazeltest
@@ -305,8 +305,8 @@ tasks:
       - "//src:bazel_nojdk.exe"
     include_json_profile:
       - build
-  rbe_ubuntu2004:
-    platform: ubuntu2004
+  rbe_ubuntu2404:
+    platform: ubuntu2404
     name: "RBE"
     build_flags:
       - "--config=remote"
@@ -362,6 +362,14 @@ tasks:
       - "-//src/test/shell/bazel:bazel_sandboxing_networking_test"
       # Disable some Android tests since we are moving Android rules out of the Bazel repo.
       - "-//src/test/shell/bazel:bazel_android_tools_test"
+      # Disable tests that fail on RBE due to sandboxing/mount restrictions
+      - "-//src/test/shell/integration:sandboxing_test"
+      - "-//src/test/java/com/google/devtools/build/lib/shell:CommandUsingLinuxSandboxTest"
+      - "-//src/test/shell/bazel:bazel_spawnstats_test"
+      - "-//src/test/shell/integration:bazel_hardened_sandboxed_worker_test"
+      - "-//src/test/shell/integration:test_test"
+      - "-//src/test/tools:daemonize_test"
+      - "-//src/test/tools:linux-sandbox_test"
     include_json_profile:
       - build
       - test
diff --git a/.bazelrc b/.bazelrc
index a9c3518b091d04..3e356218b7723f 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -11,17 +11,16 @@ build:remote_shared --action_env=PATH=/bin:/usr/bin:/usr/local/bin
 build:remote_shared --java_runtime_version=rbe_jdk
 build:remote_shared --tool_java_runtime_version=rbe_jdk
 
-# Configuration to build and test Bazel on RBE on Ubuntu 18.04 with Java 11
-build:ubuntu2004 --extra_toolchains=@rbe_ubuntu2004//java:all
-build:ubuntu2004 --crosstool_top=@rbe_ubuntu2004//cc:toolchain
-build:ubuntu2004 --extra_toolchains=@rbe_ubuntu2004//config:cc-toolchain
-build:ubuntu2004 --extra_execution_platforms=//:rbe_ubuntu2004_platform,//:rbe_ubuntu2004_highcpu_platform
-build:ubuntu2004 --host_platform=//:rbe_ubuntu2004_platform
-build:ubuntu2004 --platforms=//:rbe_ubuntu2004_platform
-build:ubuntu2004 --config=remote_shared
+# Configuration to build and test Bazel on RBE on Ubuntu 20.04
+common:ubuntu2404 --extra_toolchains=@rbe_ubuntu2404//java:all
+common:ubuntu2404 --extra_toolchains=@rbe_ubuntu2404//config:cc-toolchain
+common:ubuntu2404 --extra_execution_platforms=//:rbe_ubuntu2404_platform,//:rbe_ubuntu2404_highcpu_platform
+common:ubuntu2404 --host_platform=//:rbe_ubuntu2404_platform
+common:ubuntu2404 --platforms=//:rbe_ubuntu2404_platform
+common:ubuntu2404 --config=remote_shared
 
 # Alias
-build:remote --config=ubuntu2004
+common:remote --config=ubuntu2404
 
 build:macos --macos_minimum_os=10.13
 
diff --git a/BUILD b/BUILD
index 96536fc048ab36..a9c51c7cfebcfb 100644
--- a/BUILD
+++ b/BUILD
@@ -289,7 +289,7 @@ platform(
     ],
 )
 
-REMOTE_PLATFORMS = ("rbe_ubuntu2004",)
+REMOTE_PLATFORMS = ("rbe_ubuntu2404",)
 
 [
     platform(
diff --git a/MODULE.bazel b/MODULE.bazel
index add40a64ee78b2..2ed7a5c74a3bcf 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -400,8 +400,8 @@ bazel_dep(name = "wabt", version = "1.0.37")
 rbe_preconfig = use_repo_rule("@bazel_ci_rules//:rbe_repo.bzl", "rbe_preconfig")
 
 rbe_preconfig(
-    name = "rbe_ubuntu2004",
-    toolchain = "ubuntu2004",
+    name = "rbe_ubuntu2404",
+    toolchain = "ubuntu2404",
 )
 
 list_source_repository = use_repo_rule("//src/test/shell/bazel:list_source_repository.bzl", "list_source_repository")
diff --git a/scripts/BUILD b/scripts/BUILD
index 2d479f531fdb38..810362da213ab1 100644
--- a/scripts/BUILD
+++ b/scripts/BUILD
@@ -54,6 +54,7 @@ filegroup(
         "@platforms//os:macos": [":jq_macos"],
         "@platforms//os:windows": ["@jq_windows_amd64//file"],
     }),
+    visibility = ["//src/test:__subpackages__"],
 )
 
 sh_test(
diff --git a/src/test/shell/bazel/BUILD b/src/test/shell/bazel/BUILD
index 078c867be1ba10..aed4bd02fb52c8 100644
--- a/src/test/shell/bazel/BUILD
+++ b/src/test/shell/bazel/BUILD
@@ -656,7 +656,13 @@ sh_test(
 sh_test(
     name = "bazel_cc_code_coverage_test",
     srcs = ["bazel_cc_code_coverage_test.sh"],
-    data = [":test-deps"],
+    data = [
+        ":test-deps",
+        "//scripts:jq",
+    ],
+    env = {
+        "JQ_RLOCATIONPATH": "$(rlocationpath //scripts:jq)",
+    },
     tags = [
         # C++ coverage is not supported on macOS yet.
         "no_macos",
diff --git a/src/test/shell/bazel/bazel_cc_code_coverage_test.sh b/src/test/shell/bazel/bazel_cc_code_coverage_test.sh
index 31798e6db88069..658aa456357286 100755
--- a/src/test/shell/bazel/bazel_cc_code_coverage_test.sh
+++ b/src/test/shell/bazel/bazel_cc_code_coverage_test.sh
@@ -23,6 +23,9 @@ source "${CURRENT_DIR}/../integration_test_setup.sh" \
 source "${CURRENT_DIR}/coverage_helpers.sh" \
   || { echo "coverage_helpers.sh not found!" >&2; exit 1; }
 
+JQ="$(rlocation "$JQ_RLOCATIONPATH")"
+[[ ! -x "$JQ" ]] && fail "jq not found at $JQ ($JQ_RLOCATIONPATH)"
+
 # Check if all the tools required by CC coverage are installed.
 [[ -z $( which gcov ) ]] && fail "gcov not installed. Skipping test" && exit 0
 [[ -z $( which g++ ) ]] && fail "g++ not installed. Skipping test" && exit 0
@@ -254,12 +257,58 @@ lcount:5,1"
 function assert_gcov_coverage_srcs_a_cc_json() {
     local output_file="${1}"; shift
 
-    # The expected coverage result for coverage_srcs/a.cc in gcov format.
+    local file_name="coverage_srcs/a.cc"
     cat > expected_gcov_result_a_cc <<EOF
-{"lines": [{"branches": [], "count": 1, "line_number": 4, "unexecuted_block": false, "function_name": "_Z1ab"}, {"branches": [], "count": 1, "line_number": 5, "unexecuted_block": false, "function_name": "_Z1ab"}, {"branches": [], "count": 1, "line_number": 6, "unexecuted_block": false, "function_name": "_Z1ab"}, {"branches": [], "count": 0, "line_number": 8, "unexecuted_block": true, "function_name": "_Z1ab"}], "functions": [{"blocks": 4, "end_column": 1, "start_line": 4, "name": "_Z1ab", "blocks_executed": 3, "execution_count": 1, "demangled_name": "a(bool)", "start_column": 5, "end_line": 10}], "file": "coverage_srcs/a.cc"}
+{
+  "file": "$file_name",
+  "functions": [
+    {
+      "blocks": 4,
+      "blocks_executed": 3,
+      "demangled_name": "a(bool)",
+      "end_column": 1,
+      "end_line": 10,
+      "execution_count": 1,
+      "name": "_Z1ab",
+      "start_column": 5,
+      "start_line": 4
+    }
+  ],
+  "lines": [
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z1ab",
+      "line_number": 4,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z1ab",
+      "line_number": 5,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z1ab",
+      "line_number": 6,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 0,
+      "function_name": "_Z1ab",
+      "line_number": 8,
+      "unexecuted_block": true
+    }
+  ]
+}
 EOF
-local expected_gcov_result_a_cc=$(cat expected_gcov_result_a_cc | tr -d '\n')
-    assert_coverage_result "$expected_gcov_result_a_cc" "$output_file"
+    "$JQ" --sort-keys ".files[] | select(.file == \"$file_name\")" "$output_file" > actual_gcov_result_a_cc
+    diff -u expected_gcov_result_a_cc actual_gcov_result_a_cc \
+        || fail "Coverage result for $file_name in gcov format is different than expected"
 }
 
 
@@ -270,34 +319,172 @@ local expected_gcov_result_a_cc=$(cat expected_gcov_result_a_cc | tr -d '\n')
 function assert_gcov_coverage_srcs_t_cc_json() {
     local output_file="${1}"; shift
 
-    # The expected coverage result for coverage_srcs/t.cc in gcov format.
+    local file_name="coverage_srcs/t.cc"
     cat > expected_gcov_result_t_cc <<EOF
-{"lines": [{"branches": [], "count": 1, "line_number": 5, "unexecuted_block": false, "function_name": "main"}, {"branches": [], "count": 1, "line_number": 6, "unexecuted_block": false, "function_name": "main"}, {"branches": [], "count": 1, "line_number": 7, "unexecuted_block": false, "function_name": "main"}, {"branches": [], "count": 1, "line_number": 8, "unexecuted_block": false, "function_name": "main"}], "functions": [{"blocks": 4, "end_column": 1, "start_line": 5, "name": "main", "blocks_executed": 4, "execution_count": 1, "demangled_name": "main", "start_column": 5, "end_line": 8}], "file": "coverage_srcs/t.cc"}
+{
+  "file": "$file_name",
+  "functions": [
+    {
+      "blocks": 4,
+      "blocks_executed": 4,
+      "demangled_name": "main",
+      "end_column": 1,
+      "end_line": 8,
+      "execution_count": 1,
+      "name": "main",
+      "start_column": 5,
+      "start_line": 5
+    }
+  ],
+  "lines": [
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "main",
+      "line_number": 5,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "main",
+      "line_number": 6,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "main",
+      "line_number": 7,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "main",
+      "line_number": 8,
+      "unexecuted_block": false
+    }
+  ]
+}
 EOF
-    local expected_gcov_result_t_cc=$(cat expected_gcov_result_t_cc | tr -d '\n')
-    assert_coverage_result "$expected_gcov_result_t_cc" "$output_file"
+    "$JQ" --sort-keys ".files[] | select(.file == \"$file_name\")" "$output_file" > actual_gcov_result_t_cc
+    diff -u expected_gcov_result_t_cc actual_gcov_result_t_cc \
+        || fail "Coverage result for $file_name in gcov format is different than expected"
 }
 
 function assert_gcov_coverage_srcs_b_h_json() {
     local output_file="${1}"; shift
 
-    # The expected coverage result for coverage_srcs/b.h in gcov format.
+    local file_name="coverage_srcs/b.h"
     cat > expected_gcov_result_b_h <<EOF
-{"lines": [{"branches": [], "count": 1, "line_number": 1, "unexecuted_block": false, "function_name": "_Z1bi"}, {"branches": [], "count": 1, "line_number": 2, "unexecuted_block": false, "function_name": "_Z1bi"}, {"branches": [], "count": 1, "line_number": 3, "unexecuted_block": false, "function_name": "_Z1bi"}, {"branches": [], "count": 0, "line_number": 5, "unexecuted_block": true, "function_name": "_Z1bi"}], "functions": [{"blocks": 4, "end_column": 1, "start_line": 1, "name": "_Z1bi", "blocks_executed": 3, "execution_count": 1, "demangled_name": "b(int)", "start_column": 5, "end_line": 7}], "file": "coverage_srcs/b.h"}
+{
+  "file": "$file_name",
+  "functions": [
+    {
+      "blocks": 4,
+      "blocks_executed": 3,
+      "demangled_name": "b(int)",
+      "end_column": 1,
+      "end_line": 7,
+      "execution_count": 1,
+      "name": "_Z1bi",
+      "start_column": 5,
+      "start_line": 1
+    }
+  ],
+  "lines": [
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z1bi",
+      "line_number": 1,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z1bi",
+      "line_number": 2,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z1bi",
+      "line_number": 3,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 0,
+      "function_name": "_Z1bi",
+      "line_number": 5,
+      "unexecuted_block": true
+    }
+  ]
+}
 EOF
-    local expected_gcov_result_b_h=$(cat expected_gcov_result_b_h | tr -d '\n')
-    assert_coverage_result "$expected_gcov_result_b_h" "$output_file"
+    "$JQ" --sort-keys ".files[] | select(.file == \"$file_name\")" "$output_file" > actual_gcov_result_b_h
+    diff -u expected_gcov_result_b_h actual_gcov_result_b_h \
+        || fail "Coverage result for $file_name in gcov format is different than expected"
 }
 
 function assert_gcov_coverage_srcs_d_a_cc_json() {
     local output_file="${1}"; shift
 
-    # The expected coverage result for coverage_srcs/different/a.cc in gcov format.
+    local file_name="coverage_srcs/different/a.cc"
     cat > expected_gcov_result_d_a_cc <<EOF
-{"lines": [{"branches": [], "count": 1, "line_number": 1, "unexecuted_block": false, "function_name": "_Z11different_ab"}, {"branches": [], "count": 1, "line_number": 2, "unexecuted_block": false, "function_name": "_Z11different_ab"}, {"branches": [], "count": 0, "line_number": 3, "unexecuted_block": true, "function_name": "_Z11different_ab"}, {"branches": [], "count": 1, "line_number": 5, "unexecuted_block": false, "function_name": "_Z11different_ab"}], "functions": [{"blocks": 4, "end_column": 1, "start_line": 1, "name": "_Z11different_ab", "blocks_executed": 3, "execution_count": 1, "demangled_name": "different_a(bool)", "start_column": 5, "end_line": 7}], "file": "coverage_srcs/different/a.cc"}
+{
+  "file": "$file_name",
+  "functions": [
+    {
+      "blocks": 4,
+      "blocks_executed": 3,
+      "demangled_name": "different_a(bool)",
+      "end_column": 1,
+      "end_line": 7,
+      "execution_count": 1,
+      "name": "_Z11different_ab",
+      "start_column": 5,
+      "start_line": 1
+    }
+  ],
+  "lines": [
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z11different_ab",
+      "line_number": 1,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z11different_ab",
+      "line_number": 2,
+      "unexecuted_block": false
+    },
+    {
+      "branches": [],
+      "count": 0,
+      "function_name": "_Z11different_ab",
+      "line_number": 3,
+      "unexecuted_block": true
+    },
+    {
+      "branches": [],
+      "count": 1,
+      "function_name": "_Z11different_ab",
+      "line_number": 5,
+      "unexecuted_block": false
+    }
+  ]
+}
 EOF
-local expected_gcov_result_d_a_cc=$(cat expected_gcov_result_d_a_cc | tr -d '\n')
-    assert_coverage_result "$expected_gcov_result_d_a_cc" "$output_file"
+    "$JQ" --sort-keys ".files[] | select(.file == \"$file_name\")" "$output_file" > actual_gcov_result_d_a_cc
+    diff -u expected_gcov_result_d_a_cc actual_gcov_result_d_a_cc \
+        || fail "Coverage result for $file_name in gcov format is different than expected"
 }
 
 function test_cc_test_coverage_gcov() {