diff --git a/Cargo.toml b/Cargo.toml
index 7906b43c04..be16c16969 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -43,39 +43,39 @@ quilkin-macros = { version = "0.5.0-dev", path = "./macros" }
 # Crates.io
 arc-swap = { version = "1.5.1", features = ["serde"] }
 async-stream = "0.3.3"
-base64 = "0.13.0"
+base64 = "0.13.1"
 base64-serde = "0.6.1"
 bytes = { version = "1.2.1", features = ["serde"] }
-cached = "0.39.0"
-chrono = "0.4.22"
-clap = { version = "4.0.13", features = ["cargo", "derive", "env"] }
+cached = "0.40.0"
+chrono = "0.4.23"
+clap = { version = "4.0.26", features = ["cargo", "derive", "env"] }
 dashmap = "5.4.0"
 dirs2 = "3.0.1"
 either = "1.8.0"
 enum-map = "2.4.1"
 eyre = "0.6.8"
-futures = "0.3.24"
-hyper = { version = "0.14.20", features = ["http2"] }
-hyper-rustls = { version = "0.23.0", features = ["http2", "webpki-roots"] }
+futures = "0.3.25"
+hyper = { version = "0.14.23", features = ["http2"] }
+hyper-rustls = { version = "0.23.1", features = ["http2", "webpki-roots"] }
 ipnetwork = "0.20.0"
 k8s-openapi = { version = "0.16.0", features = ["v1_22", "schemars"] }
-kube = { version = "0.75.0", features = ["derive", "runtime", "rustls-tls", "client"], default-features = false }
+kube = { version = "0.76.0", features = ["derive", "runtime", "rustls-tls", "client"], default-features = false }
 maxminddb = "0.23.0"
 notify = "5.0.0"
-num_cpus = "1.13.1"
-once_cell = "1.15.0"
+num_cpus = "1.14.0"
+once_cell = "1.16.0"
 parking_lot = "0.12.1"
-prometheus = { version = "0.13.2", default-features = false }
-prost = "=0.9.0"
-prost-types = "=0.9.0"
+prometheus = { version = "0.13.3", default-features = false }
+prost = "0.11.2"
+prost-types = "0.11.2"
 rand = "0.8.5"
-regex = "1.6.0"
+regex = "1.7.0"
 schemars = { version = "0.8.11", features = ["chrono", "bytes", "url"] }
-serde = { version = "1.0.145", features = ["derive", "rc"] }
-serde_json = "1.0.86"
+serde = { version = "1.0.147", features = ["derive", "rc"] }
+serde_json = "1.0.88"
 serde_regex = "1.1.0"
 serde_stacker = "0.1.6"
-serde_yaml = "0.9.13"
+serde_yaml = "0.9.14"
 snap = "1.0.5"
 socket2 = "0.4.7"
 stable-eyre = "0.2.2"
@@ -83,30 +83,32 @@ tempdir = "0.3.7"
 thiserror = "1.0.37"
 tokio = { version = "1.21.2", features = ["rt-multi-thread", "fs", "signal", "test-util", "parking_lot", "tracing"] }
 tokio-stream = { version = "0.1.11", features = ["sync"] }
-tonic = "0.6.1"
+tonic = "0.8.2"
 tracing = "0.1.37"
 tracing-futures = { version = "0.2.5", features = ["futures-03"] }
 tracing-subscriber = { version = "0.3.16", features = ["json", "env-filter"] }
 tryhard = "0.5.0"
 url = { version = "2.3.1", features = ["serde"] }
-uuid = { version = "1.2.1", default-features = false, features = ["v4"] }
+uuid = { version = "1.2.2", default-features = false, features = ["v4"] }
 lasso = { version = "0.6.0", features = ["multi-threaded"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 sys-info = "0.9.1"
 
 [dev-dependencies]
-regex = "1.6.0"
+regex = "1.7.0"
 criterion = { version = "0.4.0", features = ["html_reports"] }
-once_cell = "1.15.0"
+once_cell = "1.16.0"
 tracing-test = "0.2.3"
 pretty_assertions = "1.3.0"
 
 [build-dependencies]
-tonic-build = { version = "0.6.0", default_features = false, features = ["transport", "prost"] }
-# Locked to 0.8 to match `tonic-build`'s `prost-build`.
-prost-build = "=0.9.0"
+tonic-build = { version = "0.8.2", default_features = false, features = ["transport", "prost"] }
+prost-build = "0.11.2"
 built = { version = "0.5.1", features = ["git2"] }
+protobuf-src = { version = "1.1.0", optional = true }
 
 [features]
+default = ["vendor-protoc"]
 instrument = []
+vendor-protoc = ["dep:protobuf-src"]
diff --git a/agones/Cargo.toml b/agones/Cargo.toml
index 00d1ff4d17..1679c7a0e3 100644
--- a/agones/Cargo.toml
+++ b/agones/Cargo.toml
@@ -26,6 +26,6 @@ readme = "README.md"
 [dependencies]
 base64 = "0.13.0"
 k8s-openapi = { version = "0.16.0", features = ["v1_22"] }
-kube = { version = "0.75.0", features = ["runtime", "derive"] }
+kube = { version = "0.76.0", features = ["runtime", "derive"] }
 quilkin = { path = "../" }
 tokio = { version = "1.21.2", features = ["sync", "parking_lot"] }
diff --git a/build.rs b/build.rs
index 203d5de4f9..e7c5bee88d 100644
--- a/build.rs
+++ b/build.rs
@@ -17,6 +17,9 @@
 // This build script is used to generate the rust source files that
 // we need for XDS GRPC communication.
 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    #[cfg(feature = "vendor-protoc")]
+    std::env::set_var("PROTOC", protobuf_src::protoc());
+
     let proto_files = vec![
         "proto/data-plane-api/envoy/config/common/matcher/v3/matcher.proto",
         "proto/data-plane-api/envoy/config/accesslog/v3/accesslog.proto",
diff --git a/build/Makefile b/build/Makefile
index a17f8a3949..caff175a84 100644
--- a/build/Makefile
+++ b/build/Makefile
@@ -151,8 +151,9 @@ else
 		-v $(CARGO_HOME)/registry:/root/.cargo/registry \
 		-e "CARGO_TARGET_DIR=$(CARGO_TARGET_DIR)" \
 		-e "CC=o64-clang" -e "CXX=o64-clang++" \
+		-e "PROTOC=/opt/protoc/bin/protoc" \
 		us-docker.pkg.dev/quilkin/ci/rust-linux-darwin-builder:$(rust_toolchain) \
-			sh -c "rustup target add x86_64-apple-darwin && cargo $(cargo_build_x86_64_apple)"
+			sh -c "/workspace/build/darwin-builder/setup.sh && cargo $(cargo_build_x86_64_apple) --no-default-features"
 endif
 
 # Build container image.
diff --git a/build/darwin-builder/setup.sh b/build/darwin-builder/setup.sh
new file mode 100755
index 0000000000..76597d0ba5
--- /dev/null
+++ b/build/darwin-builder/setup.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+#
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -eo pipefail
+
+mkdir -p /opt/protoc
+pushd /opt/protoc
+apt-get update
+apt-get -y install unzip
+curl "https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-$(uname -m).zip" -L -o protoc.zip
+unzip protoc.zip
+popd
+/opt/protoc/bin/protoc --version
+rustup target add x86_64-apple-darwin
diff --git a/examples/quilkin-filter-example/Cargo.toml b/examples/quilkin-filter-example/Cargo.toml
index ea355185ff..2269979dda 100644
--- a/examples/quilkin-filter-example/Cargo.toml
+++ b/examples/quilkin-filter-example/Cargo.toml
@@ -27,14 +27,15 @@ edition = "2021"
 # If lifting this example, you will want to be explicit about the Quilkin version, e.g.
 # quilkin = "0.2.0"
 quilkin = { path = "../../" }
-tokio = { version = "1.13.1", features = ["full"] }
-tonic = "0.6.1"
-prost = "0.9.0"
-prost-types = "0.9.0"
-serde = "1.0"
-serde_yaml = "0.8"
-bytes = "1.1.0"
-schemars = "0.8.8"
+tokio = { version = "1.21.2", features = ["full"] }
+tonic = "0.8.2"
+prost = "0.11.2"
+prost-types = "0.11.2"
+serde = "1.0.147"
+serde_yaml = "0.9.14"
+bytes = "1.2.1"
+schemars = "0.8.11"
 
 [build-dependencies]
-prost-build = "0.9.0"
+prost-build = "0.11.2"
+protobuf-src = "1.1.0"
diff --git a/examples/quilkin-filter-example/build.rs b/examples/quilkin-filter-example/build.rs
index 2fd8118432..9fd32c1b69 100644
--- a/examples/quilkin-filter-example/build.rs
+++ b/examples/quilkin-filter-example/build.rs
@@ -16,6 +16,9 @@
 
 // ANCHOR: build
 fn main() {
+    // Remove if you already have `protoc` installed in your system.
+    std::env::set_var("PROTOC", protobuf_src::protoc());
+
     prost_build::compile_protos(&["src/greet.proto"], &["src/"]).unwrap();
 }
 // ANCHOR_END: build