diff --git a/drake_bazel_download/BUILD.bazel b/drake_bazel_download/BUILD.bazel
index 9f1deb5b..bde5b207 100644
--- a/drake_bazel_download/BUILD.bazel
+++ b/drake_bazel_download/BUILD.bazel
@@ -1,4 +1,24 @@
 # SPDX-License-Identifier: MIT-0
 
-# This is an empty BUILD file, to ensure that this project's root directory is
-# a Bazel package.
+# We must opt-out of the py_exec_tools_toolchain, otherwise rules_python will
+# download a random copy from the internet that doesn't work correctly in CI.
+#
+# The py_exec_tools_toolchain is used to byte-compile python sources during
+# the build step (vs the first time they are run) for improved performance.
+# We don't need that optimization in this project.
+
+load(
+    "@rules_python//python:py_exec_tools_toolchain.bzl",
+    "py_exec_tools_toolchain",
+)
+
+py_exec_tools_toolchain(
+    name = "python_no_exec_tools",
+    exec_interpreter = "@rules_python//python:none",
+)
+
+toolchain(
+    name = "python_no_exec_tools_toolchain",
+    toolchain = ":python_no_exec_tools",
+    toolchain_type = "@rules_python//python:exec_tools_toolchain_type",
+)
diff --git a/drake_bazel_download/MODULE.bazel b/drake_bazel_download/MODULE.bazel
index 60c951e9..945a8dc7 100644
--- a/drake_bazel_download/MODULE.bazel
+++ b/drake_bazel_download/MODULE.bazel
@@ -3,12 +3,15 @@
 module(name = "drake_external_examples")
 
 # Add the Bazel rulesets we need.
-bazel_dep(name = "rules_cc", version = "0.0.9")
-bazel_dep(name = "rules_python", version = "0.31.0")
+bazel_dep(name = "rules_cc", version = "0.0.17")
+bazel_dep(name = "rules_python", version = "0.40.0")
 
 # Use the host system python.
 register_toolchains("@bazel_tools//tools/python:autodetecting_toolchain")
 
+# Disable the exec tools toolchain.
+register_toolchains("//:python_no_exec_tools_toolchain")
+
 # Use the host system Eigen.
 local_eigen_repositiory = use_repo_rule("//:eigen.bzl", "local_eigen_repository")
 local_eigen_repositiory(name = "eigen")