diff --git a/MODULE.bazel b/MODULE.bazel
index 72c982f..40a398b 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -10,6 +10,7 @@
 bazel_dep(name = "rules_java", version = "8.16.1")
 bazel_dep(name = "rules_jvm_external", version = "6.10")
 bazel_dep(name = "rules_python", version = "1.7.0")
+bazel_dep(name = "rules_shell", version = "0.7.1")
 
 gerrit_api_version = use_repo_rule(
     "//:gerrit_api_version.bzl",
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 4f288b6..eb69744 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -225,7 +225,8 @@
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
     "https://bcr.bazel.build/modules/rules_shell/0.4.1/MODULE.bazel": "00e501db01bbf4e3e1dd1595959092c2fadf2087b2852d3f553b5370f5633592",
-    "https://bcr.bazel.build/modules/rules_shell/0.4.1/source.json": "4757bd277fe1567763991c4425b483477bb82e35e777a56fd846eb5cceda324a",
+    "https://bcr.bazel.build/modules/rules_shell/0.7.1/MODULE.bazel": "257dd8d667371de804918dfceb86f6ddd2e1b5e025f5d9322878d4a73dc8aa58",
+    "https://bcr.bazel.build/modules/rules_shell/0.7.1/source.json": "9e6c3ea5766b584f60a44dd36520c4be16a12bb173aad238e018f73083e8feb6",
     "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca",
     "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046",
     "https://bcr.bazel.build/modules/rules_swift/2.1.1/source.json": "40fc69dfaac64deddbb75bd99cdac55f4427d9ca0afbe408576a65428427a186",
diff --git a/gerrit_plugin.bzl b/gerrit_plugin.bzl
index a47fb78..eba7dce 100644
--- a/gerrit_plugin.bzl
+++ b/gerrit_plugin.bzl
@@ -101,7 +101,6 @@
         deps = [],
         ext_deps = [],
         ext_repo = None,
-        provided_deps = [],
         srcs = [],
         resources = [],
         resource_jars = [],
@@ -121,7 +120,6 @@
       ext_deps: List of Maven coordinates for external dependencies.
       ext_repo: Name of the external repository generated by rules_jvm_external.
         Defaults to `<name>_plugin_deps`.
-      provided_deps: List of dependencies that are provided by Gerrit and should not be bundled.
       srcs: List of Java source files for the plugin.
       resources: List of resource files to be included in the plugin JAR.
       resource_jars: List of JARs containing resources.
@@ -130,7 +128,9 @@
       dir_name: The directory name for the plugin, used in stamping. Defaults to `name`.
       license: Optional plugin-owned license file to package as `META-INF/LICENSE`.
       target_suffix: Suffix to append to the final plugin JAR name.
-      deploy_env: Environment variables for the deploy JAR.
+      deploy_env: List of java_binary targets representing the runtime/deployment
+        environment that will load this plugin. Dependencies shared with these
+        targets are excluded from this binary's runtime classpath and deploy jar.
       **kwargs: Additional arguments passed to the underlying `java_library` and `java_binary` rules.
 
     This rule creates a deployable .jar file for a Gerrit plugin."""
@@ -152,7 +152,7 @@
         name = name + "__plugin",
         srcs = srcs,
         resources = resources,
-        deps = provided_deps + deps + gerrit_api_neverlink(name),
+        deps = deps + gerrit_api_neverlink(name),
         runtime_deps = runtime_deps,
         visibility = ["//visibility:public"],
         **kwargs
@@ -248,6 +248,7 @@
       deps: List of additional Bazel dependencies for the test target.
       plugin: Name of the plugin under test. Only required if `exports`,
         `ext_deps`, or automatic plugin target wiring is used.
+        Only either `ext_deps` or `exports` is allowed.
       ext_deps: List of Maven coordinates for external test dependencies.
         When set, dependency tests are generated automatically.
       ext_repo: Name of the external repository generated by rules_jvm_external.
@@ -256,7 +257,8 @@
         is added automatically if not already present.
       exports: List of targets to export for in-tree testing. Must be used together
         with `plugin` argument. Targets will also be added as dependencies to
-        the test target created by this rule.
+        the test target created by this rule. Deprecated in favor of `ext_deps`.
+        Only either `ext_deps` or `exports` is allowed.
       skip_dependency_tests: Whether to skip generating dependency tests when
         `ext_deps` and `plugin` are set. Defaults to `False`.
       dependency_test_name: Name of the generated dependency test suite.
@@ -268,6 +270,9 @@
       **kwargs: Additional arguments passed to the underlying `junit_tests` rule.
     """
 
+    if ext_deps and exports:
+        fail("Only either provide `exports` (deprecated) or `ext_deps` (recommended).")
+
     if plugin:
         if name == None:
             name = plugin + "_tests"
@@ -282,9 +287,15 @@
     if plugin and plugin not in tags:
         tags = tags + [plugin]
 
-    if exports:
+    if plugin:
+        deps = [":%s__plugin" % plugin] + deps
+
+    if ext_deps or exports:
         if not plugin:
-            fail("plugin argument must be set when exports are provided")
+            fail("gerrit_plugin_tests: `plugin` must be set when `ext_deps` or `exports` is provided")
+        if ext_deps:
+            exports = _artifacts(ext_deps, ext_repo)
+
         java_library(
             name = plugin + "__plugin_test_deps",
             testonly = True,
@@ -293,14 +304,6 @@
         )
         deps = deps + [":" + plugin + "__plugin_test_deps"]
 
-    if plugin:
-        deps = [":%s__plugin" % plugin] + deps
-
-    if ext_deps:
-        if ext_repo == None:
-            fail("gerrit_plugin_tests: `ext_repo` must be set when `ext_deps` are provided without `plugin`")
-        deps = deps + _artifacts(ext_deps, ext_repo)
-
     junit_tests(
         name = name,
         srcs = srcs,
diff --git a/tools/runtime_jars_allowlist.bzl b/tools/runtime_jars_allowlist.bzl
index 719c29b..24570e9 100644
--- a/tools/runtime_jars_allowlist.bzl
+++ b/tools/runtime_jars_allowlist.bzl
@@ -1,3 +1,4 @@
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load("//tools:java_runtime_jars_manifest.bzl", "java_runtime_jars_manifest")
 
 def runtime_jars_allowlist_test(
@@ -35,7 +36,7 @@
     if hint:
         args.append(hint)
 
-    native.sh_test(
+    sh_test(
         name = name,
         size = size,
         srcs = ["@com_googlesource_gerrit_bazlets//tools:diff_allowlist.sh"],
diff --git a/tools/runtime_jars_overlap.bzl b/tools/runtime_jars_overlap.bzl
index 3c4d8b7..d567d21 100644
--- a/tools/runtime_jars_overlap.bzl
+++ b/tools/runtime_jars_overlap.bzl
@@ -1,3 +1,4 @@
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load("//tools:java_runtime_jars_manifest.bzl", "java_runtime_jars_manifest")
 
 def runtime_jars_overlap_test(
@@ -17,7 +18,7 @@
       against: label of a generated text manifest (e.g. "//:release.war.jars.txt").
       normalize/exclude_self: controls jar ID normalization and self-jar exclusion.
       hint: optional help printed on failure.
-      **kwargs: forwarded to native.sh_test (e.g. tags, target_compatible_with).
+      **kwargs: forwarded to sh_test (e.g. tags, target_compatible_with).
     """
     plugin_manifest = name + "_manifest"
 
@@ -35,7 +36,7 @@
     if hint:
         args.append(hint)
 
-    native.sh_test(
+    sh_test(
         name = name,
         size = size,
         srcs = ["@com_googlesource_gerrit_bazlets//tools:diff_overlap.sh"],