diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3feaebf428..249f81ad3b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -65,6 +65,15 @@ END_UNRELEASED_TEMPLATE
   default to `true`.
 * (pypi) The data files of a wheel (bin, includes, etc) are now always included
   as a library's data dependencies.
+* (deps/bzlmod) Bumped the bzlmod `rules_cc` dependency from `0.1.5` to
+  `0.2.17`. This is the minimum version exposing
+  `cc/toolchains:feature_injection.bzl`, which the BazelCI-injected
+  `buildkite_config//cc/cc_toolchain_config.bzl` now loads unconditionally
+  on RBE. The WORKSPACE `http_archive` pin is left at `0.1.5` because
+  `rules_cc` 0.2.17+ requires consumers to also call
+  `compatibility_proxy_repo()` in their WORKSPACE, which would be a
+  breaking change for existing users; WORKSPACE consumers don't use RBE
+  in this repo and aren't affected by the BazelCI change.
 
 {#v0-0-0-fixed}
 ### Fixed
diff --git a/MODULE.bazel b/MODULE.bazel
index ae007c4aaf..ab1c41bc09 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -8,7 +8,7 @@ bazel_dep(name = "bazel_features", version = "1.21.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "package_metadata", version = "0.0.7")
 bazel_dep(name = "platforms", version = "0.0.11")
-bazel_dep(name = "rules_cc", version = "0.1.5")
+bazel_dep(name = "rules_cc", version = "0.2.17")
 
 # Those are loaded only when using py_proto_library
 # Use py_proto_library directly from protobuf repository
diff --git a/tests/integration/local_toolchains/MODULE.bazel b/tests/integration/local_toolchains/MODULE.bazel
index fe90fa235a..694e1088a6 100644
--- a/tests/integration/local_toolchains/MODULE.bazel
+++ b/tests/integration/local_toolchains/MODULE.bazel
@@ -16,7 +16,7 @@ module(name = "module_under_test")
 bazel_dep(name = "rules_python", version = "0.0.0")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "platforms", version = "0.0.11")
-bazel_dep(name = "rules_cc", version = "0.1.5")
+bazel_dep(name = "rules_cc", version = "0.2.17")
 
 local_path_override(
     module_name = "rules_python",