diff --git a/BUILD.bazel b/BUILD.bazel
index 3e9ab56915..656e4129bb 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -666,6 +666,7 @@ sh_binary(
         "$(rootpath @buildifier_prebuilt//:buildifier)",
         "$(rootpath //bazel:bzl_lint_test.sh)",
         "$(rootpath @buildifier_prebuilt//:buildifier)",
+        "$(rootpath @git)",
     ],
     data = [
         "MODULE.bazel",
@@ -677,5 +678,6 @@ sh_binary(
         "//bazel:tclfmt",
         "//bazel:tclint",
         "@buildifier_prebuilt//:buildifier",
+        "@git",
     ],
 )
diff --git a/bazel/fix_lint.sh b/bazel/fix_lint.sh
index f5faab6084..d65c38e7ab 100755
--- a/bazel/fix_lint.sh
+++ b/bazel/fix_lint.sh
@@ -6,17 +6,27 @@
 # that file-discovery logic is not duplicated (DRY).
 set -euo pipefail
 
+TCL_TIDY_SH="$1"
+TCLFMT="$2"
+TCL_LINT_SH="$3"
+TCLINT="$4"
+BZL_TIDY_SH="$5"
+BZL_FMT_BUILDIFIER="$6"
+BZL_LINT_SH="$7"
+BZL_LINT_BUILDIFIER="$8"
+GIT="$9"
+
 export BUILD_WORKSPACE_DIRECTORY="${BUILD_WORKSPACE_DIRECTORY:-$PWD}"
 
 # TCL: auto-format then lint
-"$1" "$2"
-"$3" "$4" || rc=$?
+"${TCL_TIDY_SH}" "${TCLFMT}"
+"${TCL_LINT_SH}" "${TCLINT}" "${GIT}" || rc=$?
 
 # Bazel: auto-format then lint
-"$5" "$6"
-"$7" "$8" || rc=$?
+"${BZL_TIDY_SH}" "${BZL_FMT_BUILDIFIER}"
+"${BZL_LINT_SH}" "${BZL_LINT_BUILDIFIER}" "${GIT}" || rc=$?
 
-git -C "$BUILD_WORKSPACE_DIRECTORY" status
+"${GIT}" -C "$BUILD_WORKSPACE_DIRECTORY" status
 
 if [ "${rc:-0}" -ne 0 ]; then
     echo "Error: lint violations remain that require manual fixes." >&2