diff --git a/.bazelversion b/.bazelversion
index 1502020..815da58 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-7.3.0
+7.4.1
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a99624f..2838867 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -22,12 +22,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: greut/eclint-action@v0
       - uses: jidicula/clang-format-action@v4.11.0
-        with: { clang-format-version: "18" }
+        with: { clang-format-version: "19" }
 
   test-windows:
     if: >-
       (github.event_name == 'pull_request' && (github.event.pull_request.user.login == 'renovate[bot]' || github.event.pull_request.user.login == 'seaubot'))
       || (github.event_name == 'merge_group' && github.event.pull_request.user.login != 'renovate[bot]' && github.event.pull_request.user.login != 'seaubot')
+      || contains(github.event.pull_request.labels.*.name, 'ci:always')
     runs-on: windows-latest
     steps:
       - uses: actions/cache@v4
@@ -46,6 +47,7 @@ jobs:
     if: >-
       (github.event_name == 'pull_request' && (github.event.pull_request.user.login == 'renovate[bot]' || github.event.pull_request.user.login == 'seaubot'))
       || (github.event_name == 'merge_group' && github.event.pull_request.user.login != 'renovate[bot]' && github.event.pull_request.user.login != 'seaubot')
+      || contains(github.event.pull_request.labels.*.name, 'ci:always')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/cache@v4
diff --git a/bazel/tools/wsc.sh b/bazel/tools/wsc.sh
old mode 100755
new mode 100644