diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh b/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh
index f9120cd..1bc58d3 100755
--- a/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh
+++ b/src/s-core-devcontainer/.devcontainer/s-core-local/install.sh
@@ -57,11 +57,11 @@ rm /tmp/bazelisk.deb
 
 # Pre-install a fixed Bazel version, setup the bash command completion
 export USE_BAZEL_VERSION=${bazel_version}
-bazel help completion > /tmp/bazel-complete.bash
+bazel help completion bash > /tmp/bazel-complete.bash
 ls -lah /tmp/bazel-complete.bash
 mkdir -p /etc/bash_completion.d
 mv /tmp/bazel-complete.bash /etc/bash_completion.d/bazel-complete.bash
-sh -c "echo 'export USE_BAZEL_VERSION=${bazel_version}' >> /etc/profile.d/bazel.sh"
+sh -c "echo 'INSTALLED_BAZEL_VERSION=${bazel_version}' >> /devcontainer/features/s-core-local/bazel_setup.sh"
 
 # Buildifier, directly from GitHub (apparently no APT repository available)
 # The version is pinned to a specific release, and the SHA256 checksum is provided by the devcontainer-features.json file.
diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/install_matching_bazel_version.sh b/src/s-core-devcontainer/.devcontainer/s-core-local/install_matching_bazel_version.sh
index 0ffd36a..ecf0044 100755
--- a/src/s-core-devcontainer/.devcontainer/s-core-local/install_matching_bazel_version.sh
+++ b/src/s-core-devcontainer/.devcontainer/s-core-local/install_matching_bazel_version.sh
@@ -1,10 +1,19 @@
 #!/usr/bin/env bash
 set -eo pipefail
 
-if [ -f .bazelversion ] && [ "$(cat .bazelversion)" != "$(bazel version | grep 'Build label:' | awk '{print $3}')" ]; then
+. /devcontainer/features/s-core-local/bazel_setup.sh || true
+
+if [ -f .bazelversion ] && [ "$(cat .bazelversion)" != "$INSTALLED_BAZEL_VERSION" ]; then
     # Pre-install the matching Bazel version, setup the bash command completion
     USE_BAZEL_VERSION=$(cat .bazelversion)
-    bazel help completion > /tmp/bazel-complete.bash
+
+    min_bazel_version_for_bash_option="8.4.0"
+    bash=""
+    if [ "$(printf '%s\n' "$min_bazel_version_for_bash_option" "$USE_BAZEL_VERSION" | sort -V | head -n1)" = "$min_bazel_version_for_bash_option" ]; then
+        bash="bash"
+    fi
+
+    bazel help completion ${bash} > /tmp/bazel-complete.bash
     sudo mv /tmp/bazel-complete.bash /etc/bash_completion.d/bazel-complete.bash
-    sudo sed -i '/^USE_BAZEL_VERSION=/c\USE_BAZEL_VERSION=${USE_BAZEL_VERSION}' /etc/profile.d/bazel.sh || true
+    echo "INSTALLED_BAZEL_VERSION=$USE_BAZEL_VERSION" | sudo tee /devcontainer/features/s-core-local/bazel_setup.sh
 fi
diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh b/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh
index 9c39f27..f11ebcc 100755
--- a/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh
+++ b/src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh
@@ -29,7 +29,14 @@ check "validate pylint is working" bash -c "pylint --version"
 
 # Bazel-related tools
 check "validate bazelisk is working and has the correct version" bash -c "bazelisk version | grep '${bazelisk_version}'"
+
+## This is the bazel version preinstalled in the devcontainer.
+## A solid test would disable the network interface first to prevent a different version from being downloaded,
+## but that requires CAP_NET_ADMIN, which is not yet added.
+export USE_BAZEL_VERSION=${bazel_version}
 check "validate bazel is working and has the correct version" bash -c "bazel version | grep '${bazel_version}'"
+unset USE_BAZEL_VERSION
+
 check "validate buildifier is working and has the correct version" bash -c "buildifier --version | grep '${buildifier_version}'"
 check "validate starpls is working and has the correct version" bash -c "starpls version | grep '${starpls_version}'"
 check "validate bazel-compile-commands is working and has the correct version" bash -c "bazel-compile-commands --version 2>&1 | grep '${bazel_compile_commands_version}'"