diff --git a/pkgs/development/tools/bazel-watcher/default.nix b/pkgs/development/tools/bazel-watcher/default.nix
index a109fe440399..38ea03d9f95b 100644
--- a/pkgs/development/tools/bazel-watcher/default.nix
+++ b/pkgs/development/tools/bazel-watcher/default.nix
@@ -10,6 +10,7 @@
 let
   patches = [
     ./use-go-in-path.patch
+    ./fix-rules-go-3408.patch
   ];
 
   # Patch the protoc alias so that it always builds from source.
@@ -29,13 +30,13 @@ let
 in
 buildBazelPackage rec {
   pname = "bazel-watcher";
-  version = "0.17.0";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazel-watcher";
     rev = "v${version}";
-    sha256 = "sha256-aK18Q2nYxYajk9f/EEmtV7YJ8cYqbamR7vh3BTgu53Q=";
+    sha256 = "sha256-wigrE9u1VuFnqLWyVJK3M7xsjyme2dDG6YTcD9whKnw=";
   };
 
   nativeBuildInputs = [ go git python3 ];
@@ -44,7 +45,7 @@ buildBazelPackage rec {
   bazel = bazel_5;
   bazelFlags = [ "--override_repository=rules_proto=${rulesProto}" ];
   bazelBuildFlags = lib.optionals stdenv.cc.isClang [ "--cxxopt=-x" "--cxxopt=c++" "--host_cxxopt=-x" "--host_cxxopt=c++" ];
-  bazelTarget = "//ibazel";
+  bazelTarget = "//cmd/ibazel";
 
   fetchConfigured = false; # we want to fetch all dependencies, regardless of the current system
   fetchAttrs = {
@@ -81,7 +82,7 @@ buildBazelPackage rec {
       rm -rf $bazelOut/external/com_google_protobuf
     '';
 
-    sha256 = "sha256-tRtlwv38bExvtHaCbRUp1kLgxvZSNaYCpFG/wwrkFrk=";
+    sha256 = "sha256-le8IepS+IGVX45Gj1aicPjYOkuUA+VVUy/PEeKLNYss=";
   };
 
   buildAttrs = {
@@ -90,12 +91,12 @@ buildBazelPackage rec {
     preBuild = ''
       patchShebangs .
 
-      substituteInPlace ibazel/BUILD --replace '{STABLE_GIT_VERSION}' ${version}
+      substituteInPlace cmd/ibazel/BUILD.bazel --replace '{STABLE_GIT_VERSION}' ${version}
       echo ${bazel_5.version} > .bazelversion
     '';
 
     installPhase = ''
-      install -Dm755 bazel-bin/ibazel/ibazel_/ibazel $out/bin/ibazel
+      install -Dm755 bazel-bin/cmd/ibazel/ibazel_/ibazel $out/bin/ibazel
     '';
   };
 
diff --git a/pkgs/development/tools/bazel-watcher/fix-rules-go-3408.patch b/pkgs/development/tools/bazel-watcher/fix-rules-go-3408.patch
new file mode 100644
index 000000000000..b28090f7ba7c
--- /dev/null
+++ b/pkgs/development/tools/bazel-watcher/fix-rules-go-3408.patch
@@ -0,0 +1,18 @@
+diff --git a/WORKSPACE b/WORKSPACE
+index 555ab93..9f3b8a0 100644
+--- a/WORKSPACE
++++ b/WORKSPACE
+@@ -46,10 +46,11 @@ rules_proto_toolchains()
+ # gazelle:repository go_repository name=com_github_bazelbuild_rules_go importpath=github.com/bazelbuild/rules_go
+ http_archive(
+     name = "io_bazel_rules_go",
+-    sha256 = "56d8c5a5c91e1af73eca71a6fab2ced959b67c86d12ba37feedb0a2dfea441a6",
++    sha256 = "7fd912837cc971b708037ab1d0d721b892c62dadbfdcfae5066e8e90d25876e9",
++    strip_prefix = "rules_go-8d309d5af15814b4096d80b60f80fa86128c43f2",
+     urls = [
+-        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.37.0/rules_go-v0.37.0.zip",
+-        "https://github.com/bazelbuild/rules_go/releases/download/v0.37.0/rules_go-v0.37.0.zip",
++        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/archive/8d309d5af15814b4096d80b60f80fa86128c43f2.zip",
++        "https://github.com/bazelbuild/rules_go/archive/8d309d5af15814b4096d80b60f80fa86128c43f2.zip",
+     ],
+ )
diff --git a/pkgs/development/tools/bazel-watcher/use-go-in-path.patch b/pkgs/development/tools/bazel-watcher/use-go-in-path.patch
index d9d90c9127f0..5ce4f81ff3ae 100644
--- a/pkgs/development/tools/bazel-watcher/use-go-in-path.patch
+++ b/pkgs/development/tools/bazel-watcher/use-go-in-path.patch
@@ -6,8 +6,8 @@ index 51273b6..fcf9ffb 100644
  
  go_rules_dependencies()
  
--go_register_toolchains(version = "1.17.6")
+-go_register_toolchains(version = "1.19.4")
 +go_register_toolchains(go_version = "host")
  
- load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
+ load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")