diff --git a/.bazelrc b/.bazelrc
index fb5f9d6..b481c64 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,4 +1,4 @@
-build --workspace_status_command=./tools/workspace-status.sh
+build --workspace_status_command="python3 ./tools/workspace_status.py"
 build --repository_cache=~/.gerritcodereview/bazel-cache/repository
 build --experimental_strict_action_env
 build --action_env=PATH
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..b339fa4
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "modules/jgit"]
+	path = modules/jgit
+	url = ../jgit
diff --git a/BUILD b/BUILD
index d65fe65..3d84a08 100644
--- a/BUILD
+++ b/BUILD
@@ -6,7 +6,7 @@
     libs = [
         "//lib/jetty:server",
         "//lib/jetty:servlet",
-        "//lib/slf4j:slf4j-simple",
+        "//lib:slf4j-simple",
         "//java/com/google/gitiles:servlet",
     ],
     web_xml = "//resources:web_xml",
diff --git a/WORKSPACE b/WORKSPACE
index 6359814..1fd87c1 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -18,10 +18,15 @@
 
 load(
     "@com_googlesource_gerrit_bazlets//tools:maven_jar.bzl",
-    "MAVEN_CENTRAL",
     "maven_jar",
 )
 
+# JGit external repository consumed from git submodule
+local_repository(
+    name = "jgit",
+    path = "modules/jgit",
+)
+
 maven_jar(
     name = "commons-lang3",
     artifact = "org.apache.commons:commons-lang3:3.8.1",
@@ -106,7 +111,7 @@
 )
 
 maven_jar(
-    name = "servlet-api_3_1",
+    name = "servlet-api",
     artifact = "javax.servlet:javax.servlet-api:3.1.0",
     sha1 = "3cd63d075497751784b2fa84be59432f4905bf7c",
 )
@@ -148,40 +153,8 @@
     sha1 = "198ea005f41219f038f4291f0b0e9f3259730e92",
 )
 
-JGIT_VERS = "5.12.0.202106070339-r"
-
-JGIT_REPO = MAVEN_CENTRAL
-
 maven_jar(
-    name = "jgit-lib",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "b7792da62103c956d3e58e29fb2e6e5c5f0e1317",
-)
-
-maven_jar(
-    name = "jgit-servlet",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit.http.server:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "c50ee52951bdcd119af0181926c25e09ae913aab",
-)
-
-maven_jar(
-    name = "jgit-junit",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit.junit:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "1bb81c9104f318f16748dbaa43f95509a53e7aa0",
-)
-
-maven_jar(
-    name = "jgit-archive",
-    artifact = "org.eclipse.jgit:org.eclipse.jgit.archive:" + JGIT_VERS,
-    repository = JGIT_REPO,
-    sha1 = "93f59b510a923bd757ea6b2a6e359d222daf2e1d",
-)
-
-maven_jar(
-    name = "ewah",
+    name = "javaewah",
     artifact = "com.googlecode.javaewah:JavaEWAH:1.1.7",
     sha1 = "570dde3cd706ae10c62fe19b150928cfdb415e87",
 )
@@ -210,15 +183,47 @@
 )
 
 maven_jar(
+    name = "hamcrest-library",
+    artifact = "org.hamcrest:hamcrest-library:1.3",
+    sha1 = "4785a3c21320980282f9f33d0d1264a69040538f",
+)
+
+maven_jar(
     name = "hamcrest-core",
     artifact = "org.hamcrest:hamcrest-core:1.3",
     sha1 = "42a25dc3219429f0e5d060061f71acb49bf010a0",
 )
 
+maven_jar(
+    name = "mockito",
+    artifact = "org.mockito:mockito-core:2.23.0",
+    sha1 = "497ddb32fd5d01f9dbe99a2ec790aeb931dff1b1",
+)
+
+BYTE_BUDDY_VERSION = "1.9.0"
+
+maven_jar(
+    name = "bytebuddy",
+    artifact = "net.bytebuddy:byte-buddy:" + BYTE_BUDDY_VERSION,
+    sha1 = "8cb0d5baae526c9df46ae17693bbba302640538b",
+)
+
+maven_jar(
+    name = "bytebuddy-agent",
+    artifact = "net.bytebuddy:byte-buddy-agent:" + BYTE_BUDDY_VERSION,
+    sha1 = "37b5703b4a6290be3fffc63ae9c6bcaaee0ff856",
+)
+
+maven_jar(
+    name = "objenesis",
+    artifact = "org.objenesis:objenesis:2.6",
+    sha1 = "639033469776fd37c08358c6b92a4761feb2af4b",
+)
+
 SL_VERS = "1.7.26"
 
 maven_jar(
-    name = "slf4j-api",
+    name = "log-api",
     artifact = "org.slf4j:slf4j-api:" + SL_VERS,
     sha1 = "77100a62c2e6f04b53977b9f541044d7d722693d",
 )
diff --git a/java/com/google/gitiles/BUILD b/java/com/google/gitiles/BUILD
index a105f38..8e79933 100644
--- a/java/com/google/gitiles/BUILD
+++ b/java/com/google/gitiles/BUILD
@@ -15,15 +15,15 @@
     "//lib:gfm-tables",
     "//lib:gfm-strikethrough",
     "//lib:prettify",
-    "//lib/jgit:jgit",
-    "//lib/jgit:jgit-servlet",
-    "//lib/slf4j:slf4j-api",
+    "//lib:jgit",
+    "//lib:jgit-servlet",
+    "//lib:slf4j-api",
     "//lib/soy:soy",
     "//java/com/google/gitiles/blame/cache",
 ]
 
 DEPS_ALL = DEPS + [
-    "//lib/jgit:jgit-archive",
+    "//lib:jgit-archive",
     "//lib/guice:guice",
 ]
 
diff --git a/java/com/google/gitiles/blame/cache/BUILD b/java/com/google/gitiles/blame/cache/BUILD
index e1491fc..e256ea3 100644
--- a/java/com/google/gitiles/blame/cache/BUILD
+++ b/java/com/google/gitiles/blame/cache/BUILD
@@ -8,7 +8,7 @@
     visibility = ["//visibility:public"],
     deps = [
         "//lib:guava",
-        "//lib/jgit",
+        "//lib:jgit",
     ],
 )
 
@@ -17,7 +17,7 @@
     libs = [
         ":cache",
         "//lib:guava",
-        "//lib/jgit:jgit",
+        "//lib:jgit",
     ],
     pkgs = ["com.google.gitiles.blame.cache"],
     title = "Blame Cache API Documentation",
diff --git a/java/com/google/gitiles/dev/BUILD b/java/com/google/gitiles/dev/BUILD
index 9550cf0..72caf40 100644
--- a/java/com/google/gitiles/dev/BUILD
+++ b/java/com/google/gitiles/dev/BUILD
@@ -9,13 +9,13 @@
         "//lib:guava",
         "//lib:guava-failureaccess",
         "//lib:html-types",
-        "//lib:servlet-api_3_1",
+        "//lib:jgit",
+        "//lib:jgit-servlet",
+        "//lib:servlet-api",
+        "//lib:slf4j-api",
+        "//lib:slf4j-simple",
         "//lib/jetty:server",
         "//lib/jetty:servlet",
-        "//lib/jgit",
-        "//lib/jgit:jgit-servlet",
-        "//lib/slf4j:slf4j-api",
-        "//lib/slf4j:slf4j-simple",
         "//lib/soy",
     ],
 )
diff --git a/javatests/com/google/gitiles/BUILD b/javatests/com/google/gitiles/BUILD
index 4021114..5469beb 100644
--- a/javatests/com/google/gitiles/BUILD
+++ b/javatests/com/google/gitiles/BUILD
@@ -5,8 +5,8 @@
     "//lib:gson",
     "//lib:guava",
     "//lib:guava-failureaccess",
-    "//lib/jgit:jgit",
-    "//lib/jgit:jgit-servlet",
+    "//lib:jgit",
+    "//lib:jgit-servlet",
     "//lib/soy:soy",
 ]
 
@@ -21,20 +21,20 @@
         "//lib:jsr305",
         "//lib:servlet-api_2_5",
         "//lib/truth",
-        "//lib/jgit:junit",
+        "//lib:jgit-junit",
         "//lib/junit",
     ],
 )
 
 junit_tests(
     name = "servlet_tests",
+    size = "small",
     srcs = glob(
         [
             "**/*Test.java",
         ],
         exclude = ["**/ServletTest.java"],
     ),
-    size = "small",
     visibility = ["//visibility:public"],
     runtime_deps = ["//lib/junit:hamcrest-core"],
     deps = DEPS + [
@@ -42,7 +42,7 @@
         ":testutil",
         "//lib:servlet-api_2_5",
         "//lib/truth",
-        "//lib/jgit:junit",
+        "//lib:jgit-junit",
         "//lib/junit",
     ],
 )
diff --git a/lib/BUILD b/lib/BUILD
index a6f026f..0f9620e 100644
--- a/lib/BUILD
+++ b/lib/BUILD
@@ -18,7 +18,7 @@
     "html-types",
     "jsr305",
     "servlet-api_2_5",
-    "servlet-api_3_1",
+    "servlet-api",
     "gson",
     "guava",
     "guava-failureaccess",
@@ -29,3 +29,58 @@
     "ow2-asm-tree",
     "ow2-asm-util",
 ]]
+
+java_library(
+    name = "slf4j-api",
+    exports = ["@log-api//jar"],
+)
+
+java_library(
+    name = "slf4j-simple",
+    runtime_deps = [
+        ":slf4j-api",
+        "@slf4j-simple//jar",
+    ],
+)
+
+java_library(
+    name = "jgit",
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit:jgit"],
+    runtime_deps = [
+        ":slf4j-api",
+        "@javaewah//jar",
+    ],
+)
+
+java_library(
+    name = "jgit-archive",
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit.archive:jgit-archive"],
+    runtime_deps = [":jgit"],
+)
+
+java_library(
+    name = "jgit-junit",
+    testonly = True,
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit.junit:junit"],
+    runtime_deps = [":jgit"],
+)
+
+java_library(
+    name = "jgit-servlet",
+    visibility = ["//visibility:public"],
+    exports = ["@jgit//org.eclipse.jgit.http.server:jgit-servlet"],
+    runtime_deps = [":jgit"],
+)
+
+java_library(
+    name = "tukaani-xz",
+    exports = ["@tukaani-xz//jar"],
+)
+
+java_library(
+    name = "commons-compress",
+    exports = ["@commons-compress//jar"],
+)
diff --git a/lib/jetty/BUILD b/lib/jetty/BUILD
index 4f58b3d..521fd22 100644
--- a/lib/jetty/BUILD
+++ b/lib/jetty/BUILD
@@ -8,7 +8,7 @@
     name = "servlet",
     exports = [
         ":security",
-        "//lib:servlet-api_3_1",  # Different from the rest of gitiles-server.
+        "//lib:servlet-api",  # Different from the rest of gitiles-server.
         "@servlet//jar",
     ],
 )
diff --git a/lib/jgit/BUILD b/lib/jgit/BUILD
deleted file mode 100644
index d813fd7..0000000
--- a/lib/jgit/BUILD
+++ /dev/null
@@ -1,44 +0,0 @@
-load("@rules_java//java:defs.bzl", "java_library")
-
-package(
-    default_visibility = ["//visibility:public"],
-)
-
-java_library(
-    name = "jgit-servlet",
-    exports = ["@jgit-servlet//jar"],
-)
-
-java_library(
-    name = "jgit",
-    exports = ["@jgit-lib//jar"],
-)
-
-java_library(
-    name = "jgit-archive",
-    exports = [
-        ":commons-compress",
-        ":jgit-archive_library",
-        ":tukaani-xz",
-    ],
-)
-
-java_library(
-    name = "tukaani-xz",
-    exports = ["@tukaani-xz//jar"],
-)
-
-java_library(
-    name = "commons-compress",
-    exports = ["@commons-compress//jar"],
-)
-
-java_library(
-    name = "jgit-archive_library",
-    exports = ["@jgit-archive//jar"],
-)
-
-java_library(
-    name = "junit",
-    exports = ["@jgit-junit//jar"],
-)
diff --git a/lib/slf4j/BUILD b/lib/slf4j/BUILD
deleted file mode 100644
index 2719aa8..0000000
--- a/lib/slf4j/BUILD
+++ /dev/null
@@ -1,18 +0,0 @@
-load("@rules_java//java:defs.bzl", "java_library")
-
-package(
-    default_visibility = ["//visibility:public"],
-)
-
-java_library(
-    name = "slf4j-api",
-    exports = ["@slf4j-api//jar"],
-)
-
-java_library(
-    name = "slf4j-simple",
-    runtime_deps = [
-        ":slf4j-api",
-        "@slf4j-simple//jar",
-    ],
-)
diff --git a/modules/jgit b/modules/jgit
new file mode 160000
index 0000000..1f062c6
--- /dev/null
+++ b/modules/jgit
@@ -0,0 +1 @@
+Subproject commit 1f062c64be839a66e9ddd7faa0040312ef8ea774
diff --git a/tools/workspace-status.sh b/tools/workspace-status.sh
deleted file mode 100755
index 9cc40e9..0000000
--- a/tools/workspace-status.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-# This script will be run by bazel when the build process starts to
-# generate key-value information that represents the status of the
-# workspace. The output should be like
-#
-# KEY1 VALUE1
-# KEY2 VALUE2
-#
-# If the script exits with non-zero code, it's considered as a failure
-# and the output will be discarded.
-
-function rev() {
-  cd $1; git describe --always --match "v[0-9].*" --dirty
-}
-
-echo STABLE_BUILD_GITILES_LABEL $(rev .)
diff --git a/tools/workspace_status.py b/tools/workspace_status.py
new file mode 100644
index 0000000..bd0689a
--- /dev/null
+++ b/tools/workspace_status.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+
+# This script will be run by bazel when the build process starts to
+# generate key-value information that represents the status of the
+# workspace. The output should be like
+#
+# KEY1 VALUE1
+# KEY2 VALUE2
+#
+# If the script exits with non-zero code, it's considered as a failure
+# and the output will be discarded.
+
+from __future__ import print_function
+import os
+import subprocess
+import sys
+
+ROOT = os.path.abspath(__file__)
+while not os.path.exists(os.path.join(ROOT, 'WORKSPACE')):
+    ROOT = os.path.dirname(ROOT)
+CMD = ['git', 'describe', '--always', '--match', 'v[0-9].*', '--dirty']
+
+
+def revision(directory, parent):
+    try:
+        os.chdir(directory)
+        return subprocess.check_output(CMD).strip().decode("utf-8")
+    except OSError as err:
+        print('could not invoke git: %s' % err, file=sys.stderr)
+        sys.exit(1)
+    except subprocess.CalledProcessError as err:
+        # ignore "not a git repository error" to report unknown version
+        return None
+    finally:
+        os.chdir(parent)
+
+
+print("STABLE_BUILD_GITILES_LABEL %s" % revision(ROOT, ROOT))
+for kind in ['modules']:
+    kind_dir = os.path.join(ROOT, kind)
+    for d in os.listdir(kind_dir):
+        p = os.path.join(kind_dir, d)
+        if os.path.isdir(p):
+            v = revision(p, ROOT)
+            print('STABLE_BUILD_%s_LABEL %s' % (os.path.basename(p).upper(),
+                                                v if v else 'unknown'))