diff --git a/.ci/bazel-6.2.0-darwin-x86_64.sha256 b/.ci/bazel-6.2.0-darwin-x86_64.sha256
deleted file mode 100644
index c43d66990..000000000
--- a/.ci/bazel-6.2.0-darwin-x86_64.sha256
+++ /dev/null
@@ -1 +0,0 @@
-d2356012843ce3a2fbba89f88191673a6ad2f7716cc46ad43ec1bcee78d36b44  bazel-6.2.0-darwin-x86_64
diff --git a/.ci/bazel-6.2.0-linux-x86_64.sha256 b/.ci/bazel-6.2.0-linux-x86_64.sha256
deleted file mode 100644
index 26e445252..000000000
--- a/.ci/bazel-6.2.0-linux-x86_64.sha256
+++ /dev/null
@@ -1 +0,0 @@
-3d11c26fb9ba12c833844450bb90165b176e8a19cb5cf5923f3cec855837f17c  bazel-6.2.0-linux-x86_64
diff --git a/.ci/bazel-6.2.0-windows-x86_64.exe.sha256 b/.ci/bazel-6.2.0-windows-x86_64.exe.sha256
deleted file mode 100644
index eecea8507..000000000
--- a/.ci/bazel-6.2.0-windows-x86_64.exe.sha256
+++ /dev/null
@@ -1 +0,0 @@
-3d119e934ffb26910fcbd44dbc5973761480f58d3a06722cb84a90e16d8c5727  bazel-6.2.0-windows-x86_64.exe
diff --git a/.ci/bazel-6.4.0-darwin-x86_64.sha256 b/.ci/bazel-6.4.0-darwin-x86_64.sha256
new file mode 100644
index 000000000..22159ba23
--- /dev/null
+++ b/.ci/bazel-6.4.0-darwin-x86_64.sha256
@@ -0,0 +1 @@
+eef2661dabc3de09c9c8f839f7789b29763ea9987659e432b3c4e6246b3fe5df  bazel-6.4.0-darwin-x86_64
diff --git a/.ci/bazel-6.4.0-linux-x86_64.sha256 b/.ci/bazel-6.4.0-linux-x86_64.sha256
new file mode 100644
index 000000000..46f80cbb8
--- /dev/null
+++ b/.ci/bazel-6.4.0-linux-x86_64.sha256
@@ -0,0 +1 @@
+79e4f370efa6e31717b486af5d9efd95864d0ef13da138582224ac9b2a1bad86  bazel-6.4.0-linux-x86_64
diff --git a/.ci/bazel-6.4.0-windows-x86_64.exe.sha256 b/.ci/bazel-6.4.0-windows-x86_64.exe.sha256
new file mode 100644
index 000000000..85d98b0f6
--- /dev/null
+++ b/.ci/bazel-6.4.0-windows-x86_64.exe.sha256
@@ -0,0 +1 @@
+ff94279f7de7ec604c40b5d760f0dc10bdc880f07e915adced825f53e5f4fa1b  bazel-6.4.0-windows-x86_64.exe
diff --git a/.ci/bazelversion b/.ci/bazelversion
index 6abaeb2f9..19b860c18 100644
--- a/.ci/bazelversion
+++ b/.ci/bazelversion
@@ -1 +1 @@
-6.2.0
+6.4.0
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index d2b2c1147..e0f51dd80 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -43,7 +43,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-11]
+        os: [ubuntu-latest, macos-latest]
         module: [rules_haskell, rules_haskell_nix, rules_haskell_tests]
         bzlmod: [true, false]
         ghc:
@@ -144,7 +144,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-11, windows-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         module: [rules_haskell, rules_haskell_tests]
         bzlmod: [true, false]
         ghc:
@@ -165,14 +165,14 @@ jobs:
       # prevent auto-detection of system compilers on Windows
       BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN: ${{ matrix.os == 'windows-latest' && 1 || 0 }}
       # do not use Xcode on macOS
-      BAZEL_USE_CPP_ONLY_TOOLCHAIN: ${{ matrix.os == 'macos-11' && 1 || 0 }}
+      BAZEL_USE_CPP_ONLY_TOOLCHAIN: ${{ matrix.os == 'macos-latest' && 1 || 0 }}
       GHC_VERSION: ${{ matrix.ghc }}
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/free_disk_space_on_linux
       - uses: ./.github/actions/install_apt_pkgs
-        with: 
+        with:
           packages: libtinfo5
       - name: Mount Bazel cache
         uses: actions/cache@v3
diff --git a/README.md b/README.md
index 99ff88688..d1aa2baea 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ for Haskell. Get started building your own project using these rules
 with the [setup script below](#setup).
 
 [bazel]: https://bazel.build/
-[bazel-getting-started]: https://docs.bazel.build/versions/master/getting-started.html
+[bazel-getting-started]: https://bazel.build/start
 [bazel-cli]: https://docs.bazel.build/versions/master/command-line-reference.html
 [external-repositories]: https://docs.bazel.build/versions/master/external.html
 [nix]: https://nixos.org/nix
@@ -23,7 +23,7 @@ The full reference documentation for rules is at https://haskell.build.
 
 ## Setup
 
-You'll need [Bazel >= 5.0][bazel-getting-started] installed.
+You'll need [Bazel >= 6.0][bazel-getting-started] installed.
 
 If you are on NixOS, skip to the [Nixpkgs](#Nixpkgs) section.
 
@@ -335,12 +335,12 @@ http_archive(
 
 To reference a local checkout instead, use the
 [`--override_repository`][override_repository] command line option:
-   
+
 ```
 bazel build/test/run/sync \
   --override_repository rules_haskell=/path/to/checkout
 ```
-   
+
 If you don’t want to type that every time, [temporarily add it to
 `.bazelrc`][bazelrc].
 
diff --git a/docs/haskell-use-cases.rst b/docs/haskell-use-cases.rst
index 91c3ca969..cc6067972 100644
--- a/docs/haskell-use-cases.rst
+++ b/docs/haskell-use-cases.rst
@@ -1228,7 +1228,7 @@ configuration can be avoided by telling Nix to fetch it from the
 `haskell.nix binary cache`_.
 
 .. _arm example: https://github.com/tweag/rules_haskell/blob/master/examples/arm/arm-cross.nix
-.. _haskell.nix binary cache: https://input-output-hk.github.io/haskell.nix/tutorials/getting-started/#setting-up-the-binary-cache
+.. _haskell.nix binary cache: https://input-output-hk.github.io/haskell.nix/tutorials/getting-started.html#setting-up-the-binary-cache
 
 To tell ``rules_haskell`` about the cross-compiler, we can register it
 in the `WORKSPACE file <https://github.com/tweag/rules_haskell/blob/master/examples/arm/WORKSPACE>`_. ::
diff --git a/docs/index.rst b/docs/index.rst
index 1fb9de3de..358739d5f 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -25,5 +25,5 @@ Requirements:
    haskell-use-cases
 
 .. _Bazel: https://bazel.build
-.. _Bazel documentation: https://docs.bazel.build/versions/master/getting-started.html
+.. _Bazel documentation: https://bazel.build/start
 .. _start script: https://haskell.build/start
diff --git a/examples/non_module_deps.bzl b/examples/non_module_deps.bzl
index 04afe6c51..e92ba3ab6 100644
--- a/examples/non_module_deps.bzl
+++ b/examples/non_module_deps.bzl
@@ -21,7 +21,16 @@ cc_library(
     includes = ["."],
     visibility = ["//visibility:public"],
 )
-cc_library(name = "z", srcs = glob(["*.c"]), hdrs = glob(["*.h"]))
+cc_library(
+    name = "z",
+    srcs = glob(["*.c"]),
+    hdrs = glob(["*.h"]),
+    copts = select({
+        "@bazel_tools//src/conditions:windows": [],
+        # Needed to avoid "call to undeclared function" errors [-Wimplicit-function-declaration]
+        "//conditions:default": ["-DZ_HAVE_UNISTD_H"],
+    }),
+)
 """,
         sha256 = "b5b06d60ce49c8ba700e0ba517fa07de80b5d4628a037f4be8ad16955be7a7c0",
         strip_prefix = "zlib-1.3",
diff --git a/haskell/cabal.bzl b/haskell/cabal.bzl
index 081ab0c02..2f162f552 100644
--- a/haskell/cabal.bzl
+++ b/haskell/cabal.bzl
@@ -164,8 +164,9 @@ def _cabal_toolchain_info(hs, cc, workspace_name, runghc):
     # TODO: remove this if Bazel fixes its behavior.
     # Upstream ticket: https://github.com/bazelbuild/bazel/issues/5127.
     ar = cc.tools.ar
-    if ar.find("libtool") >= 0:
-        ar = "/usr/bin/ar"
+    if paths.basename(ar) == "libtool":
+        # assume `ar` is available at the same place
+        ar = paths.join(paths.dirname(ar), "ar")
 
     return struct(
         ghc = hs.tools.ghc.path,
diff --git a/haskell/cc.bzl b/haskell/cc.bzl
index 201b9a18c..1633b4a47 100644
--- a/haskell/cc.bzl
+++ b/haskell/cc.bzl
@@ -9,6 +9,7 @@ load(
     "C_COMPILE_ACTION_NAME",
 )
 load("@rules_cc//cc:find_cc_toolchain.bzl", "find_cc_toolchain")
+load("@bazel_skylib//lib:paths.bzl", "paths")
 load(
     "//haskell:providers.bzl",
     "GhcPluginInfo",
@@ -136,8 +137,10 @@ def cc_interop_info(ctx, override_cc_toolchain = None):
     # "/usr/bin/libtool". Since we call ar directly, override it.
     # TODO: remove this if Bazel fixes its behavior.
     # Upstream ticket: https://github.com/bazelbuild/bazel/issues/5127.
-    if tools["ar"].find("libtool") >= 0:
-        tools["ar"] = "/usr/bin/ar"
+    ar = tools["ar"]
+    if paths.basename(ar) == "libtool":
+        # assume `ar` is available at the same place
+        tools["ar"] = paths.join(paths.dirname(ar), "ar")
 
     env = {}
     if hs_toolchain.is_darwin:
diff --git a/haskell/doctest.bzl b/haskell/doctest.bzl
index 5fbbe3850..deee7fbf4 100644
--- a/haskell/doctest.bzl
+++ b/haskell/doctest.bzl
@@ -148,6 +148,9 @@ def _haskell_doctest_single(target, ctx):
         {env}
         # doctest needs PATH to call GHC and the C compiler and linker.
         export PATH
+        # signal our cc_wrapper to silence linker outputs as GHC < 9.4 writes that to
+        # the GHCI ouput which interferes with doctest's expected ouput
+        export RULES_HASKELL_SILENCE_LINKER=1
         {doctest} "$@" {inputs} > {output} 2>&1 || (rc=$? && cat {output} && exit $rc)
         """.format(
             doctest = toolchain.doctest[0].path,
diff --git a/haskell/private/cc_wrapper.py.tpl b/haskell/private/cc_wrapper.py.tpl
index 44ecb0ff2..65e86fa98 100644
--- a/haskell/private/cc_wrapper.py.tpl
+++ b/haskell/private/cc_wrapper.py.tpl
@@ -570,7 +570,10 @@ def link(output, libraries, rpaths, args):
         rpaths = shorten_rpaths(rpaths, libraries, output)
 
     args.extend(rpath_args(rpaths))
-    run_cc(args, exit_on_error=True)
+    # Note: `RULES_HASKELL_SILENCE_LINKER` is only set if called from doctest,
+    #       which is used to silence the linker output to not interfere with the output
+    #       from GHCi
+    run_cc(args, capture_output="RULES_HASKELL_SILENCE_LINKER" in os.environ, exit_on_error=True)
 
     if is_darwin():
         darwin_rewrite_load_commands(darwin_rewrites, output)
diff --git a/haskell/private/versions.bzl b/haskell/private/versions.bzl
index 15846cf0f..3f84ed377 100644
--- a/haskell/private/versions.bzl
+++ b/haskell/private/versions.bzl
@@ -15,8 +15,8 @@
 # See https://github.com/tweag/rules_haskell/pull/1781#issuecomment-1187640454
 SUPPORTED_BAZEL_VERSIONS = [
     "6.0.0",
-    "6.2.0",
     "6.3.2",
+    "6.4.0",
 ]
 
 SUPPORTED_NIXPKGS_BAZEL_PACKAGES = [
diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix
index 7cfe73d80..46f96e949 100644
--- a/nixpkgs/default.nix
+++ b/nixpkgs/default.nix
@@ -1,8 +1,8 @@
 { ... }@args:
 let
-  # 2023-10-20
-  sha256 = "07dv5x236rqf5b718b7bhpqf2yaq43h6w8mrz9fcb0hxwjzsxlpg";
-  rev = "80c1aab725151632ddc2a20caeb914e76dd0673c";
+  # 2023-11-30
+  sha256 = "sha256:06m9r85brk6pcghm63ksl2zsx9j1kbagic3fx2p656z20v1bd48z";
+  rev = "781e2a9797ecf0f146e81425c822dca69fe4a348";
 in
 import (fetchTarball {
   inherit sha256;
diff --git a/rules_haskell_tests/MODULE.bazel b/rules_haskell_tests/MODULE.bazel
index 35bdf2c01..49c6b4500 100644
--- a/rules_haskell_tests/MODULE.bazel
+++ b/rules_haskell_tests/MODULE.bazel
@@ -114,8 +114,8 @@ use_repo(
     "asterius_bundle_linux_amd64",
     "bazel_6",
     "build_bazel_bazel_6_0_0",
-    "build_bazel_bazel_6_2_0",
     "build_bazel_bazel_6_3_2",
+    "build_bazel_bazel_6_4_0",
     "glibc_locales",
     "linux_amd64_asterius-toolchain",
     "nixpkgs_config_cc",
diff --git a/rules_haskell_tests/non_module_deps.bzl b/rules_haskell_tests/non_module_deps.bzl
index 7b097ceb6..9e37ba5de 100644
--- a/rules_haskell_tests/non_module_deps.bzl
+++ b/rules_haskell_tests/non_module_deps.bzl
@@ -89,9 +89,11 @@ cc_library(
     name = "z",
     srcs = glob(["*.c"]),
     hdrs = glob(["*.h"]),
-    # Needed because XCode 12.0 Clang errors by default.
-    # See https://developer.apple.com/documentation/xcode-release-notes/xcode-12-release-notes.
-    copts = ["-Wno-error=implicit-function-declaration"],
+    copts = select({
+        "@bazel_tools//src/conditions:windows": [],
+        # Needed to avoid "call to undeclared function" errors [-Wimplicit-function-declaration]
+        "//conditions:default": ["-DZ_HAVE_UNISTD_H"],
+    }),
     # Cabal packages depending on dynamic C libraries fail on MacOS
     # due to `-rpath` flags being forwarded indiscriminately.
     # See https://github.com/tweag/rules_haskell/issues/1317
diff --git a/shell.nix b/shell.nix
index d040173ab..a3c80718f 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,6 +1,13 @@
 { pkgs ? import ./nixpkgs { }, docTools ? true, ghcVersion ? "9.2.8" }:
 
 with pkgs;
+
+let
+  macOS-security =
+    # make `/usr/bin/security` available in `PATH`, which is needed for stack
+    # on darwin which calls this binary to find certificates
+    writeScriptBin "security" ''exec /usr/bin/security "$@"'';
+in
 mkShell {
   # XXX: hack for macosX, this flags disable bazel usage of xcode
   # Note: this is set even for linux so any regression introduced by this flag
@@ -36,7 +43,9 @@ mkShell {
     # check the start script for problems
     shellcheck
     file
-  ] ++ lib.optionals docTools [ graphviz python39Packages.sphinx zip unzip ];
+  ]
+  ++ lib.optionals docTools [ graphviz python39Packages.sphinx zip unzip ]
+  ++ lib.optional stdenv.isDarwin macOS-security;
 
   packages = [ bazel_6 ];
 
diff --git a/start b/start
index 401e0fb0b..083f09a27 100755
--- a/start
+++ b/start
@@ -13,7 +13,7 @@ readonly MIN_BAZEL_MAJOR=6
 readonly MIN_BAZEL_MINOR=0
 
 readonly MAX_BAZEL_MAJOR=6
-readonly MAX_BAZEL_MINOR=3
+readonly MAX_BAZEL_MINOR=4
 
 stderr () {
   >&2 echo "$*"