diff --git a/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix b/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix
index 3bbab475c57..ae90ae0fbf7 100644
--- a/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix
@@ -1,4 +1,4 @@
-{ stdenv, writeText, runCommandCC, bazel }:
+{ stdenv, writeText, runCommandCC, bazel, runLocal, bazelTest }:
 
 # Tests that certain executables are available in bazel-executed bash shells.
 
@@ -22,21 +22,22 @@ let
     )
   '';
 
-  runLocal = name: script: runCommandCC name { preferLocalBuild = true; } script;
-
-  workspaceDir = runLocal "our_workspace" ''
+  workspaceDir = runLocal "our_workspace" {} ''
     mkdir $out
     cp ${WORKSPACE} $out/WORKSPACE
     cp ${fileIn} $out/input.txt
     cp ${fileBUILD} $out/BUILD
   '';
 
-  testBazel = runLocal "bazel-test-bash-tools" ''
-    export HOME=$(mktemp -d)
-    cp -r ${workspaceDir} wd && chmod +w wd && cd wd
-    ${bazel}/bin/bazel build :tool_usage
-    cp bazel-genfiles/output.txt $out
-    echo "Testing content" && [ "$(cat $out | wc -l)" == "2" ] && echo "OK"
-  '';
+  testBazel = bazelTest {
+    name = "bazel-test-bash-tools";
+    inherit workspaceDir;
+
+    bazelScript = ''
+      ${bazel}/bin/bazel build :tool_usage
+      cp bazel-genfiles/output.txt $out
+      echo "Testing content" && [ "$(cat $out | wc -l)" == "2" ] && echo "OK"
+    '';
+  };
 
 in testBazel
diff --git a/pkgs/development/tools/build-managers/bazel/default.nix b/pkgs/development/tools/build-managers/bazel/default.nix
index 04441cb98b4..28a48dead08 100644
--- a/pkgs/development/tools/build-managers/bazel/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/default.nix
@@ -1,5 +1,7 @@
-{ stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, makeWrapper
-, zip, unzip, bash, writeCBin, coreutils
+{ stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, runCommandCC, makeWrapper
+# this package (through the fixpoint glass)
+, bazel
+, lr, xe, zip, unzip, bash, writeCBin, coreutils
 , which, python, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
 # Apple dependencies
 , cctools, clang, libcxx, CoreFoundation, CoreServices, Foundation
@@ -109,10 +111,61 @@ stdenv.mkDerivation rec {
   #     nix-build . -A bazel.tests
   #
   # in the nixpkgs checkout root to exercise them locally.
-  passthru.tests = {
-    pythonBinPath = callPackage ./python-bin-path-test.nix {};
-    bashTools = callPackage ./bash-tools-test.nix {};
-  };
+  passthru.tests =
+    let
+      runLocal = name: attrs: script: runCommandCC name ({
+        preferLocalBuild = true;
+      } // attrs) script;
+
+      # bazel wants to extract itself into $install_dir/install every time it runs,
+      # so let’s do that only once.
+      extracted =
+        let install_dir =
+          # `install_base` field printed by `bazel info`, minus the hash.
+          # yes, this path is kinda magic. Sorry.
+          "$HOME/.cache/bazel/_bazel_nixbld";
+        in runLocal "bazel-extracted-homedir" { passthru.install_dir = install_dir; } ''
+            export HOME=$(mktemp -d)
+            touch WORKSPACE # yeah, everything sucks
+            install_base="$(${bazel}/bin/bazel info | grep install_base)"
+            # assert it’s actually below install_dir
+            [[ "$install_base" =~ ${install_dir} ]] \
+              || (echo "oh no! $install_base but we are \
+            trying to copy ${install_dir} to $out instead!"; exit 1)
+            cp -R ${install_dir} $out
+          '';
+
+      bazelTest = { name, bazelScript, workspaceDir }:
+        runLocal name {} (
+          # skip extraction caching on Darwin, because nobody knows how Darwin works
+          (lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+            # set up home with pre-unpacked bazel
+            export HOME=$(mktemp -d)
+            mkdir -p ${extracted.install_dir}
+            cp -R ${extracted}/install ${extracted.install_dir}
+
+            # https://stackoverflow.com/questions/47775668/bazel-how-to-skip-corrupt-installation-on-centos6
+            # Bazel checks whether the mtime of the install dir files
+            # is >9 years in the future, otherwise it extracts itself again.
+            # see PosixFileMTime::IsUntampered in src/main/cpp/util
+            # What the hell bazel.
+            ${lr}/bin/lr -0 -U ${extracted.install_dir} | ${xe}/bin/xe -N0 -0 touch --date="9 years 6 months" {}
+          '')
+          +
+          ''
+            # Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
+            # about why to create a subdir for the workspace.
+            cp -r ${workspaceDir} wd && chmod u+w wd && cd wd
+
+            ${bazelScript}
+
+            touch $out
+          '');
+
+    in {
+      pythonBinPath = callPackage ./python-bin-path-test.nix{ inherit runLocal bazelTest; };
+      bashTools = callPackage ./bash-tools-test.nix { inherit runLocal bazelTest; };
+    };
 
   name = "bazel-${version}";
 
diff --git a/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix b/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
index b78b736e47f..d2b95d79ff9 100644
--- a/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, writeText, runCommandCC, bazel }:
+{ stdenv, lib, writeText, bazel, bazelTest, runLocal }:
 
 let
   WORKSPACE = writeText "WORKSPACE" ''
@@ -29,9 +29,7 @@ let
     )
   '';
 
-  runLocal = name: script: runCommandCC name { preferLocalBuild = true; } script;
-
-  workspaceDir = runLocal "our_workspace" ''
+  workspaceDir = runLocal "our_workspace" {} ''
     mkdir $out
     cp ${WORKSPACE} $out/WORKSPACE
     mkdir $out/python
@@ -40,17 +38,15 @@ let
     cp ${pythonBUILD} $out/python/BUILD.bazel
   '';
 
-  testBazel = runLocal "bazel-test-builtin-rules" ''
-    export HOME=$(mktemp -d)
-    # Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
-    # about why to create a subdir for the workspace.
-    cp -r ${workspaceDir} wd && chmod u+w wd && cd wd
-    ${bazel}/bin/bazel \
-      run \
-        --host_javabase='@local_jdk//:jdk' \
-        //python:bin
-
-    touch $out
-  '';
+  testBazel = bazelTest {
+    name = "bazel-test-builtin-rules";
+    inherit workspaceDir;
+    bazelScript = ''
+      ${bazel}/bin/bazel \
+        run \
+          --host_javabase='@local_jdk//:jdk' \
+          //python:bin
+    '';
+  };
 
 in testBazel