diff --git a/MODULE.bazel b/MODULE.bazel
index ef6a202e3dfb..82f472ca3237 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -78,6 +78,22 @@ pip.parse(
 use_repo(pip, "python_deps")
 
 # Protobuf dependencies
+# toolchains_protoc must be declared before protobuf so its toolchain registration wins
+bazel_dep(name = "toolchains_protoc", version = "0.6.1")
+
+protoc = use_extension("@toolchains_protoc//protoc:extensions.bzl", "protoc")
+protoc.toolchain(version = "v32.1")
+use_repo(
+    protoc,
+    "toolchains_protoc_hub",
+    "toolchains_protoc_hub.linux_aarch_64",
+    "toolchains_protoc_hub.linux_x86_64",
+    "toolchains_protoc_hub.osx_aarch_64",
+    "toolchains_protoc_hub.osx_x86_64",
+)
+
+register_toolchains("@toolchains_protoc_hub//:all")
+
 bazel_dep(
     name = "protobuf",
     version = "32.1",
diff --git a/bazel/BUILD.bazel b/bazel/BUILD.bazel
index c435675aceb8..bf4f60425599 100644
--- a/bazel/BUILD.bazel
+++ b/bazel/BUILD.bazel
@@ -72,6 +72,21 @@ write_info_file_var(
     visibility = ["//visibility:public"],
 )
 
+# Prebuilt protoc binary, selected by exec platform.
+# Used in cargo_build_script rules instead of @protobuf//:protoc to avoid
+# compiling protoc from C++ source on every build.
+# Platform config_settings are defined in //:BUILD.bazel alongside platform() rules.
+alias(
+    name = "protoc",
+    actual = select({
+        "@bazel_tools//src/conditions:linux_x86_64": "@toolchains_protoc_hub.linux_x86_64//:bin/protoc",
+        "@bazel_tools//src/conditions:linux_aarch64": "@toolchains_protoc_hub.linux_aarch_64//:bin/protoc",
+        "@bazel_tools//src/conditions:darwin_x86_64": "@toolchains_protoc_hub.osx_x86_64//:bin/protoc",
+        "@bazel_tools//src/conditions:darwin_arm64": "@toolchains_protoc_hub.osx_aarch_64//:bin/protoc",
+    }),
+    visibility = ["//visibility:public"],
+)
+
 exports_files(
     [
         "prost_generator.sh",
diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build
index 8b53649e7f1e..79afac787fa0 100644
--- a/bazel/conf/.bazelrc.build
+++ b/bazel/conf/.bazelrc.build
@@ -5,6 +5,10 @@
 # lockfile for MODULE.bazel
 common --lockfile_mode=off
 
+# Use prebuilt protoc binary via toolchain resolution instead of compiling from C++ source.
+# See https://github.com/protocolbuffers/protobuf/issues/19558
+common --incompatible_enable_proto_toolchain_resolution
+
 # Use hermetic JDK
 # See https://bazel.build/docs/bazel-and-java#hermetic-testing
 build --java_runtime_version=remotejdk_17
diff --git a/bazel/prost.bzl b/bazel/prost.bzl
index 6d0ecb961b60..001ef6cfdb04 100644
--- a/bazel/prost.bzl
+++ b/bazel/prost.bzl
@@ -16,13 +16,12 @@ def generated_files_check(name, srcs, deps, data, manifest_dir):
         srcs = srcs,
         data = data + [
             "@rules_rust//rust/toolchain:current_rustfmt_files",
-            "@protobuf//:protoc",
+            "//bazel:protoc",
             "@protobuf//:descriptor_proto_srcs",
-            "@protobuf//:protobuf_headers",
             "@protobuf//:well_known_type_protos",
         ],
         env = {
-            "PROTOC": "$(rootpath @protobuf//:protoc)",
+            "PROTOC": "$(rootpath //bazel:protoc)",
             "PROTOC_INCLUDE": PROTOC_INCLUDE,
             "CARGO_MANIFEST_DIR": manifest_dir,
             "RUSTFMT": "$(rootpath @rules_rust//rust/toolchain:current_rustfmt_files)",
@@ -44,13 +43,12 @@ def protobuf_generator(name, srcs, manifest_dir, deps = [], data = []):
             ":" + binary_name,
             "@protobuf//:well_known_type_protos",
             "@protobuf//:descriptor_proto_srcs",
-            "@protobuf//:protoc",
-            "@protobuf//:protobuf_headers",
+            "//bazel:protoc",
             "@rules_rust//rust/toolchain:current_rustfmt_files",
         ],
         srcs = ["//bazel:prost_generator.sh"],
         env = {
-            "PROTOC": "$(location @protobuf//:protoc)",
+            "PROTOC": "$(location //bazel:protoc)",
             "PROTOC_INCLUDE": PROTOC_INCLUDE,
             "CARGO_MANIFEST_DIR": manifest_dir,
             "GENERATOR": "$(location :%s)" % binary_name,
diff --git a/rs/bitcoin/service/BUILD.bazel b/rs/bitcoin/service/BUILD.bazel
index 6d06a0fd92c9..e3a049ab0afc 100644
--- a/rs/bitcoin/service/BUILD.bazel
+++ b/rs/bitcoin/service/BUILD.bazel
@@ -21,7 +21,7 @@ cargo_build_script(
     srcs = ["build.rs"],
     build_script_env = {
         "CARGO_MANIFEST_DIR": "rs/bitcoin/service",
-        "PROTOC": "$(execpath @protobuf//:protoc)",
+        "PROTOC": "$(execpath //bazel:protoc)",
         "RUSTFMT": "$(execpath @rules_rust//rust/toolchain:current_rustfmt_files)",
     },
     data = [
@@ -29,7 +29,7 @@ cargo_build_script(
         "@rules_rust//rust/toolchain:current_rustfmt_files",
     ],
     tools = [
-        "@protobuf//:protoc",
+        "//bazel:protoc",
     ],
     deps = [
         # Keep sorted.
diff --git a/rs/https_outcalls/service/BUILD.bazel b/rs/https_outcalls/service/BUILD.bazel
index 3e5059fe0de5..8c5ed955d400 100644
--- a/rs/https_outcalls/service/BUILD.bazel
+++ b/rs/https_outcalls/service/BUILD.bazel
@@ -21,7 +21,7 @@ cargo_build_script(
     srcs = ["build.rs"],
     build_script_env = {
         "CARGO_MANIFEST_DIR": "rs/https_outcalls/service",
-        "PROTOC": "$(execpath @protobuf//:protoc)",
+        "PROTOC": "$(execpath //bazel:protoc)",
         "RUSTFMT": "$(execpath @rules_rust//rust/toolchain:current_rustfmt_files)",
     },
     data = [
@@ -29,7 +29,7 @@ cargo_build_script(
         "@rules_rust//rust/toolchain:current_rustfmt_files",
     ],
     tools = [
-        "@protobuf//:protoc",
+        "//bazel:protoc",
     ],
     deps = [
         # Keep sorted.
diff --git a/rs/ic_os/guest_upgrade/shared/BUILD.bazel b/rs/ic_os/guest_upgrade/shared/BUILD.bazel
index 09e03262be86..3cf87bd80f59 100644
--- a/rs/ic_os/guest_upgrade/shared/BUILD.bazel
+++ b/rs/ic_os/guest_upgrade/shared/BUILD.bazel
@@ -8,15 +8,17 @@ cargo_build_script(
     srcs = ["build.rs"],
     build_script_env = {
         "CARGO_MANIFEST_DIR": "rs/ic_os/guest_upgrade/shared",
-        "PROTOC": "$(execpath @protobuf//:protoc)",
+        "PROTOC": "$(execpath //bazel:protoc)",
         "RUSTFMT": "$(execpath @rules_rust//rust/toolchain:current_rustfmt_files)",
     },
     data = [
         "proto/api.proto",
         "//rs/ic_os/sev/attestation:proto/attestation.proto",
-        "@protobuf//:protoc",
         "@rules_rust//rust/toolchain:current_rustfmt_files",
     ],
+    tools = [
+        "//bazel:protoc",
+    ],
     deps = [
         "@crate_index//:tonic-build",
     ],
diff --git a/rs/ic_os/remote_attestation/shared/BUILD.bazel b/rs/ic_os/remote_attestation/shared/BUILD.bazel
index d8b19a4f55e1..837056b5d21a 100644
--- a/rs/ic_os/remote_attestation/shared/BUILD.bazel
+++ b/rs/ic_os/remote_attestation/shared/BUILD.bazel
@@ -8,15 +8,17 @@ cargo_build_script(
     srcs = ["build.rs"],
     build_script_env = {
         "CARGO_MANIFEST_DIR": "rs/ic_os/remote_attestation/shared",
-        "PROTOC": "$(execpath @protobuf//:protoc)",
+        "PROTOC": "$(execpath //bazel:protoc)",
         "RUSTFMT": "$(execpath @rules_rust//rust/toolchain:current_rustfmt_files)",
     },
     data = [
         "proto/remote_attestation.proto",
         "//rs/ic_os/sev/attestation:proto/attestation.proto",
-        "@protobuf//:protoc",
         "@rules_rust//rust/toolchain:current_rustfmt_files",
     ],
+    tools = [
+        "//bazel:protoc",
+    ],
     deps = [
         "@crate_index//:tonic-build",
     ],
diff --git a/rs/monitoring/adapter_metrics/service/BUILD.bazel b/rs/monitoring/adapter_metrics/service/BUILD.bazel
index ef5b7c0c8d4c..824f064439d7 100644
--- a/rs/monitoring/adapter_metrics/service/BUILD.bazel
+++ b/rs/monitoring/adapter_metrics/service/BUILD.bazel
@@ -20,7 +20,7 @@ cargo_build_script(
     name = "build_script",
     srcs = ["build.rs"],
     build_script_env = {
-        "PROTOC": "$(execpath @protobuf//:protoc)",
+        "PROTOC": "$(execpath //bazel:protoc)",
         "RUSTFMT": "$(execpath @rules_rust//rust/toolchain:current_rustfmt_files)",
     },
     data = [
@@ -28,7 +28,7 @@ cargo_build_script(
         "@rules_rust//rust/toolchain:current_rustfmt_files",
     ],
     tools = [
-        "@protobuf//:protoc",
+        "//bazel:protoc",
     ],
     deps = [
         # Keep sorted.