diff --git a/WORKSPACE b/WORKSPACE
index 8109bbdd6..3e2d8b42c 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -16,6 +16,7 @@ load("@io_bazel_rules_closure//closure:defs.bzl", "closure_repositories")
 
 closure_repositories(
     omit_com_google_auto_factory = True,
+    omit_com_google_protobuf = True,
     omit_com_google_code_findbugs_jsr305 = True,
     omit_com_google_guava = True,
     omit_com_ibm_icu_icu4j = True,
diff --git a/docs/install.md b/docs/install.md
index 6f6aaec0f..ab6ea914e 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -7,8 +7,8 @@ This document covers the steps necessary to download, build, and deploy Nomulus.
 You will need the following programs installed on your local machine:
 
 *   A recent version of the [Java 8 JDK][java-jdk8].
-*   [Bazel build system](http://bazel.io/) (version [0.20.0][bazel-version]
-    works as of 2018-12-03).
+*   [Bazel build system](http://bazel.io/) (version [0.21.0][bazel-version]
+    works as of 2018-12-20).
 *   [Google App Engine SDK for Java][app-engine-sdk], and configure aliases to
     to the `gcloud` and `appcfg.sh` utilities (you'll use them a lot).
 *   [Git](https://git-scm.com/) version control system.
@@ -181,4 +181,4 @@ See the [first steps tutorial](./first-steps-tutorial.md) for more information.
 
 [app-engine-sdk]: https://cloud.google.com/appengine/docs/java/download
 [java-jdk8]: http://www.oracle.com/technetwork/java/javase/downloads
-[bazel-version]: https://github.com/bazelbuild/bazel/releases/download/0.20.0/bazel-0.20.0-installer-linux-x86_64.sh
+[bazel-version]: https://github.com/bazelbuild/bazel/releases/download/0.21.0/bazel-0.21.0-installer-linux-x86_64.sh
diff --git a/java/google/registry/repositories.bzl b/java/google/registry/repositories.bzl
index be7b0347f..30e8d930f 100644
--- a/java/google/registry/repositories.bzl
+++ b/java/google/registry/repositories.bzl
@@ -15,6 +15,7 @@
 """External dependencies for Nomulus."""
 
 
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@io_bazel_rules_closure//closure/private:java_import_external.bzl", "java_import_external")
 
 def domain_registry_bazel_check():
@@ -86,6 +87,7 @@ def domain_registry_repositories(
         omit_com_google_oauth_client_java6 = False,
         omit_com_google_oauth_client_jetty = False,
         omit_com_google_oauth_client_servlet = False,
+        omit_com_google_protobuf = False,
         omit_com_google_protobuf_java = False,
         omit_com_google_re2j = False,
         omit_com_google_template_soy = False,
@@ -297,6 +299,8 @@ def domain_registry_repositories(
         com_google_oauth_client_jetty()
     if not omit_com_google_oauth_client_servlet:
         com_google_oauth_client_servlet()
+    if not omit_com_google_protobuf:
+        com_google_protobuf()
     if not omit_com_google_protobuf_java:
         com_google_protobuf_java()
     if not omit_com_google_re2j:
@@ -1525,6 +1529,17 @@ def com_google_oauth_client_servlet():
         ],
     )
 
+def com_google_protobuf():
+    http_archive(
+        name = "com_google_protobuf",
+        strip_prefix = "protobuf-3.6.1.3",
+        sha256 = "73fdad358857e120fd0fa19e071a96e15c0f23bb25f85d3f7009abfd4f264a2a",
+        urls = [
+            "https://mirror.bazel.build/github.com/google/protobuf/archive/v3.6.1.3.tar.gz",
+            "https://github.com/protocolbuffers/protobuf/archive/v3.6.1.3.tar.gz",
+        ],
+    )
+
 def com_google_protobuf_java():
     java_import_external(
         name = "com_google_protobuf_java",