diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..b339fa4
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "modules/jgit"]
+	path = modules/jgit
+	url = ../jgit
diff --git a/WORKSPACE b/WORKSPACE
index 0739533..1fd87c1 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -18,10 +18,15 @@
 
 load(
     "@com_googlesource_gerrit_bazlets//tools:maven_jar.bzl",
-    "MAVEN_CENTRAL",
     "maven_jar",
 )
 
+# JGit external repository consumed from git submodule
+local_repository(
+    name = "jgit",
+    path = "modules/jgit",
+)
+
 maven_jar(
     name = "commons-lang3",
     artifact = "org.apache.commons:commons-lang3:3.8.1",
@@ -148,38 +153,6 @@
     sha1 = "198ea005f41219f038f4291f0b0e9f3259730e92",
 )
 
-JGIT_VERS = "5.12.0.202106070339-r"
-
-JGIT_REPO = MAVEN_CENTRAL
-
-maven_jar(
-    name = "jgit-lib",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "b7792da62103c956d3e58e29fb2e6e5c5f0e1317",
-)
-
-maven_jar(
-    name = "jgit-servlet",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit.http.server:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "c50ee52951bdcd119af0181926c25e09ae913aab",
-)
-
-maven_jar(
-    name = "jgit-junit",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit.junit:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "1bb81c9104f318f16748dbaa43f95509a53e7aa0",
-)
-
-maven_jar(
-    name = "jgit-archive",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit.archive:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "93f59b510a923bd757ea6b2a6e359d222daf2e1d",
-)
-
 maven_jar(
     name = "javaewah",
     artifact = "com.googlecode.javaewah:JavaEWAH:1.1.7",
@@ -210,11 +183,43 @@
 )
 
 maven_jar(
+    name = "hamcrest-library",
+    artifact = "org.hamcrest:hamcrest-library:1.3",
+    sha1 = "4785a3c21320980282f9f33d0d1264a69040538f",
+)
+
+maven_jar(
     name = "hamcrest-core",
     artifact = "org.hamcrest:hamcrest-core:1.3",
     sha1 = "42a25dc3219429f0e5d060061f71acb49bf010a0",
 )
 
+maven_jar(
+    name = "mockito",
+    artifact = "org.mockito:mockito-core:2.23.0",
+    sha1 = "497ddb32fd5d01f9dbe99a2ec790aeb931dff1b1",
+)
+
+BYTE_BUDDY_VERSION = "1.9.0"
+
+maven_jar(
+    name = "bytebuddy",
+    artifact = "net.bytebuddy:byte-buddy:" + BYTE_BUDDY_VERSION,
+    sha1 = "8cb0d5baae526c9df46ae17693bbba302640538b",
+)
+
+maven_jar(
+    name = "bytebuddy-agent",
+    artifact = "net.bytebuddy:byte-buddy-agent:" + BYTE_BUDDY_VERSION,
+    sha1 = "37b5703b4a6290be3fffc63ae9c6bcaaee0ff856",
+)
+
+maven_jar(
+    name = "objenesis",
+    artifact = "org.objenesis:objenesis:2.6",
+    sha1 = "639033469776fd37c08358c6b92a4761feb2af4b",
+)
+
 SL_VERS = "1.7.26"
 
 maven_jar(
diff --git a/java/com/google/gitiles/BUILD b/java/com/google/gitiles/BUILD
index de70adb..8e79933 100644
--- a/java/com/google/gitiles/BUILD
+++ b/java/com/google/gitiles/BUILD
@@ -15,15 +15,15 @@
     "//lib:gfm-tables",
     "//lib:gfm-strikethrough",
     "//lib:prettify",
-    "//lib/jgit:jgit",
-    "//lib/jgit:jgit-servlet",
+    "//lib:jgit",
+    "//lib:jgit-servlet",
     "//lib:slf4j-api",
     "//lib/soy:soy",
     "//java/com/google/gitiles/blame/cache",
 ]
 
 DEPS_ALL = DEPS + [
-    "//lib/jgit:jgit-archive",
+    "//lib:jgit-archive",
     "//lib/guice:guice",
 ]
 
diff --git a/java/com/google/gitiles/blame/cache/BUILD b/java/com/google/gitiles/blame/cache/BUILD
index e1491fc..e256ea3 100644
--- a/java/com/google/gitiles/blame/cache/BUILD
+++ b/java/com/google/gitiles/blame/cache/BUILD
@@ -8,7 +8,7 @@
     visibility = ["//visibility:public"],
     deps = [
         "//lib:guava",
-        "//lib/jgit",
+        "//lib:jgit",
     ],
 )
 
@@ -17,7 +17,7 @@
     libs = [
         ":cache",
         "//lib:guava",
-        "//lib/jgit:jgit",
+        "//lib:jgit",
     ],
     pkgs = ["com.google.gitiles.blame.cache"],
     title = "Blame Cache API Documentation",
diff --git a/java/com/google/gitiles/dev/BUILD b/java/com/google/gitiles/dev/BUILD
index 942cb2b..1394fff 100644
--- a/java/com/google/gitiles/dev/BUILD
+++ b/java/com/google/gitiles/dev/BUILD
@@ -12,8 +12,8 @@
         "//lib:servlet-api",
         "//lib/jetty:server",
         "//lib/jetty:servlet",
-        "//lib/jgit",
-        "//lib/jgit:jgit-servlet",
+        "//lib:jgit",
+        "//lib:jgit-servlet",
         "//lib:slf4j-api",
         "//lib:slf4j-simple",
         "//lib/soy",
diff --git a/javatests/com/google/gitiles/BUILD b/javatests/com/google/gitiles/BUILD
index 4021114..8597e2e 100644
--- a/javatests/com/google/gitiles/BUILD
+++ b/javatests/com/google/gitiles/BUILD
@@ -5,8 +5,8 @@
     "//lib:gson",
     "//lib:guava",
     "//lib:guava-failureaccess",
-    "//lib/jgit:jgit",
-    "//lib/jgit:jgit-servlet",
+    "//lib:jgit",
+    "//lib:jgit-servlet",
     "//lib/soy:soy",
 ]
 
@@ -21,7 +21,7 @@
         "//lib:jsr305",
         "//lib:servlet-api_2_5",
         "//lib/truth",
-        "//lib/jgit:junit",
+        "//lib:jgit-junit",
         "//lib/junit",
     ],
 )
@@ -42,7 +42,7 @@
         ":testutil",
         "//lib:servlet-api_2_5",
         "//lib/truth",
-        "//lib/jgit:junit",
+        "//lib:jgit-junit",
         "//lib/junit",
     ],
 )
diff --git a/lib/BUILD b/lib/BUILD
index 282643d..0f9620e 100644
--- a/lib/BUILD
+++ b/lib/BUILD
@@ -42,3 +42,45 @@
         "@slf4j-simple//jar",
     ],
 )
+
+java_library(
+    name = "jgit",
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit:jgit"],
+    runtime_deps = [
+        ":slf4j-api",
+        "@javaewah//jar",
+    ],
+)
+
+java_library(
+    name = "jgit-archive",
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit.archive:jgit-archive"],
+    runtime_deps = [":jgit"],
+)
+
+java_library(
+    name = "jgit-junit",
+    testonly = True,
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit.junit:junit"],
+    runtime_deps = [":jgit"],
+)
+
+java_library(
+    name = "jgit-servlet",
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit.http.server:jgit-servlet"],
+    runtime_deps = [":jgit"],
+)
+
+java_library(
+    name = "tukaani-xz",
+    exports = ["@tukaani-xz//jar"],
+)
+
+java_library(
+    name = "commons-compress",
+    exports = ["@commons-compress//jar"],
+)
diff --git a/lib/jgit/BUILD b/lib/jgit/BUILD
deleted file mode 100644
index d813fd7..0000000
--- a/lib/jgit/BUILD
+++ /dev/null
@@ -1,44 +0,0 @@
-load("@rules_java//java:defs.bzl", "java_library")
-
-package(
-    default_visibility = ["//visibility:public"],
-)
-
-java_library(
-    name = "jgit-servlet",
-    exports = ["@jgit-servlet//jar"],
-)
-
-java_library(
-    name = "jgit",
-    exports = ["@jgit-lib//jar"],
-)
-
-java_library(
-    name = "jgit-archive",
-    exports = [
-        ":commons-compress",
-        ":jgit-archive_library",
-        ":tukaani-xz",
-    ],
-)
-
-java_library(
-    name = "tukaani-xz",
-    exports = ["@tukaani-xz//jar"],
-)
-
-java_library(
-    name = "commons-compress",
-    exports = ["@commons-compress//jar"],
-)
-
-java_library(
-    name = "jgit-archive_library",
-    exports = ["@jgit-archive//jar"],
-)
-
-java_library(
-    name = "junit",
-    exports = ["@jgit-junit//jar"],
-)
diff --git a/modules/jgit b/modules/jgit
new file mode 160000
index 0000000..1f062c6
--- /dev/null
+++ b/modules/jgit
@@ -0,0 +1 @@
+Subproject commit 1f062c64be839a66e9ddd7faa0040312ef8ea774
diff --git a/tools/workspace_status.py b/tools/workspace_status.py
index aae9318..bd0689a 100644
--- a/tools/workspace_status.py
+++ b/tools/workspace_status.py
@@ -36,3 +36,11 @@
 
 
 print("STABLE_BUILD_GITILES_LABEL %s" % revision(ROOT, ROOT))
+for kind in ['modules']:
+    kind_dir = os.path.join(ROOT, kind)
+    for d in os.listdir(kind_dir):
+        p = os.path.join(kind_dir, d)
+        if os.path.isdir(p):
+            v = revision(p, ROOT)
+            print('STABLE_BUILD_%s_LABEL %s' % (os.path.basename(p).upper(),
+                                                v if v else 'unknown'))