diff --git a/rules/bitstreams.bzl b/rules/bitstreams.bzl
index a1dbb7b2e59cd..3f94dafacf6aa 100644
--- a/rules/bitstreams.bzl
+++ b/rules/bitstreams.bzl
@@ -48,8 +48,6 @@ particular bitstream or use cached version for the next cache entry, for each
 design (i.e. mix-and-match).
 """
 
-load("@python3//:defs.bzl", "interpreter")
-
 def _bitstreams_repo_impl(rctx):
     # First, check if an existing pre-built bitstream cache repo exists, and if
     # so, use it instead of building one.
@@ -112,7 +110,7 @@ bitstreams_repo = repository_rule(
             default = 18 * 3600,  # Refresh every 18h
         ),
         "python_interpreter": attr.label(
-            default = interpreter,
+            default = "@python3_host//:python",
             allow_single_file = True,
             doc = "Python interpreter to use.",
         ),
diff --git a/third_party/python/pip.bzl b/third_party/python/pip.bzl
index ff2e1da75b84b..d5aa074063e37 100644
--- a/third_party/python/pip.bzl
+++ b/third_party/python/pip.bzl
@@ -3,11 +3,10 @@
 # SPDX-License-Identifier: Apache-2.0
 
 load("@rules_python//python:pip.bzl", "pip_parse")
-load("@python3//:defs.bzl", "interpreter")
 
 def pip_deps():
     pip_parse(
         name = "ot_python_deps",
-        python_interpreter_target = interpreter,
+        python_interpreter_target = "@python3_host//:python",
         requirements_lock = "@lowrisc_opentitan//:python-requirements.txt",
     )
diff --git a/third_party/python/python.MODULE.bazel b/third_party/python/python.MODULE.bazel
new file mode 100644
index 0000000000000..8401df964d7a7
--- /dev/null
+++ b/third_party/python/python.MODULE.bazel
@@ -0,0 +1,31 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+# Dependencies:
+bazel_dep(name = "rules_python", version = "0.39.0")
+
+# Python toolchain:
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(
+    # Required because CI containers currently run as the `root` user.
+    # We lose caching of `.pyc` files as a result.
+    # See <https://github.com/bazelbuild/rules_python/pull/713>.
+    ignore_root_user_error = True,
+    is_default = True,
+    python_version = "3.9",
+)
+use_repo(python, "pythons_hub")
+register_toolchains("@pythons_hub//:all")
+
+# We occasionally access the toolchain repositories directly to use interpreters.
+use_repo(python, python3 = "python_3_9", python3_host = "python_3_9_host")
+
+# Pip dependencies:
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(
+    hub_name = "ot_python_deps",
+    python_version = "3.9",
+    requirements_lock = "//:python-requirements.txt",
+)
+use_repo(pip, "ot_python_deps")