diff --git a/.bazelversion b/.bazelversion
index a57c344a29..21e00cfe03 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1,3 +1,3 @@
-3.6.0
+4.0.0
 # [NB: this comment has to be after the first line, see https://github.com/bazelbuild/bazelisk/issues/117]
 # When updating the Bazel version you also need to update the RBE toolchains version in package.bzl
diff --git a/WORKSPACE b/WORKSPACE
index 6c90ad7619..371ff87b6c 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -76,7 +76,7 @@ rbe_autoconfig(
     # Need to specify a base container digest in order to ensure that we can use the checked-in
     # platform configurations for the "ubuntu16_04" image. Otherwise the autoconfig rule would
     # need to pull the image and run it in order determine the toolchain configuration. See:
-    # https://github.com/bazelbuild/bazel-toolchains/blob/3.6.0/configs/ubuntu16_04_clang/versions.bzl
+    # https://github.com/bazelbuild/bazel-toolchains/blob/4.0.0/configs/ubuntu16_04_clang/versions.bzl
     base_container_digest = "sha256:f6568d8168b14aafd1b707019927a63c2d37113a03bcee188218f99bd0327ea1",
     # Note that if you change the `digest`, you might also need to update the
     # `base_container_digest` to make sure marketplace.gcr.io/google/rbe-ubuntu16-04-webtest:<digest>
diff --git a/dev-infra/BUILD.bazel b/dev-infra/BUILD.bazel
index c753f2abfb..d064b9320d 100644
--- a/dev-infra/BUILD.bazel
+++ b/dev-infra/BUILD.bazel
@@ -58,7 +58,7 @@ pkg_npm(
         # This substitution is particularly verbose because we need to make sure
         # that only things available via Angular Bazel are imported from
         # tools/defaults.bzl.
-        "load\(\"//tools:defaults.bzl\", \"ng_module\"\)": "load(\"@npm//@angular/bazel:index.bzl\", \"ng_module\")",
+        "load(\"//tools:defaults.bzl\", \"ng_module\")": "load(\"@npm//@angular/bazel:index.bzl\", \"ng_module\")",
     },
     visibility = ["//visibility:public"],
     deps = [
diff --git a/packages/bazel/BUILD.bazel b/packages/bazel/BUILD.bazel
index 8ac0f195f6..f5b10a87c9 100644
--- a/packages/bazel/BUILD.bazel
+++ b/packages/bazel/BUILD.bazel
@@ -17,7 +17,7 @@ pkg_npm(
         "//packages/bazel/docs",
     ],
     substitutions = {
-        "(#|\/\/)\\s+BEGIN-DEV-ONLY[\\w\W]+?(#|\/\/)\\s+END-DEV-ONLY": "",
+        "(#|//)\\s+BEGIN-DEV-ONLY[\\w\\W]+?(#|//)\\s+END-DEV-ONLY": "",
         "//packages/bazel/": "//@angular/bazel/",
         "@npm//@bazel/typescript/internal:": "//@bazel/typescript/internal:",
     },
diff --git a/packages/bazel/package.bzl b/packages/bazel/package.bzl
index 4ebf61a888..22838f6b19 100644
--- a/packages/bazel/package.bzl
+++ b/packages/bazel/package.bzl
@@ -29,11 +29,11 @@ def rules_angular_dev_dependencies():
     _maybe(
         http_archive,
         name = "bazel_toolchains",
-        sha256 = "4fb3ceea08101ec41208e3df9e56ec72b69f3d11c56629d6477c0ff88d711cf7",
-        strip_prefix = "bazel-toolchains-3.6.0",
+        sha256 = "1adf5db506a7e3c465a26988514cfc3971af6d5b3c2218925cd6e71ee443fc3f",
+        strip_prefix = "bazel-toolchains-4.0.0",
         urls = [
-            "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/releases/download/3.6.0/bazel-toolchains-3.6.0.tar.gz",
-            "https://github.com/bazelbuild/bazel-toolchains/releases/download/3.6.0/bazel-toolchains-3.6.0.tar.gz",
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/releases/download/4.0.0/bazel-toolchains-4.0.0.tar.gz",
+            "https://github.com/bazelbuild/bazel-toolchains/releases/download/4.0.0/bazel-toolchains-4.0.0.tar.gz",
         ],
     )
 
diff --git a/packages/common/locales/BUILD.bazel b/packages/common/locales/BUILD.bazel
index c887cc32ae..20c6fa9511 100644
--- a/packages/common/locales/BUILD.bazel
+++ b/packages/common/locales/BUILD.bazel
@@ -23,7 +23,7 @@ pkg_npm(
         # dependencies in case require was called.
         # We don't actually import anything in the locale code so we can
         # null out the require reference passed into the module.
-        "factory\(require, exports\)": "factory(null, exports)",
+        "factory\\(require, exports\\)": "factory(null, exports)",
     },
     deps = [":locales"],
 )
diff --git a/packages/private/testing/BUILD.bazel b/packages/private/testing/BUILD.bazel
index 549768807d..029fc75e86 100644
--- a/packages/private/testing/BUILD.bazel
+++ b/packages/private/testing/BUILD.bazel
@@ -30,5 +30,5 @@ ng_module(
 genrule(
     name = "angular_ivy_enabled",
     outs = ["src/angular_ivy_enabled.ts"],
-    cmd = "echo export const ivyEnabled = \"'True'.toString() == '$(angular_ivy_enabled)'\"\; > $@",
+    cmd = "echo export const ivyEnabled = \"'True'.toString() == '$(angular_ivy_enabled)'\" > $@",
 )