diff --git a/BUILD.bazel b/BUILD.bazel
index 67fb6217d3..bbeddef661 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -79,6 +79,7 @@ pkg_npm(
     srcs = glob(["*.bzl"]) + [
         "BUILD.bazel",
         "LICENSE",
+        "rules_sass.pr126.patch",
     ],
     substitutions = COMMON_REPLACEMENTS,
     deps = [
diff --git a/e2e/node_loader_preserve_symlinks/BUILD.bazel b/e2e/node_loader_preserve_symlinks/BUILD.bazel
index ff7bc2228f..edf8636a04 100644
--- a/e2e/node_loader_preserve_symlinks/BUILD.bazel
+++ b/e2e/node_loader_preserve_symlinks/BUILD.bazel
@@ -9,4 +9,6 @@ nodejs_test(
     ],
     entry_point = ":node_loader_test.spec.js",
     node_modules = "@npm//:node_modules",
+    # legacy "node_modules" attribute means linker didn't see deps
+    templated_args = ["--bazel_patch_module_resolver"],
 )
diff --git a/e2e/packages/BUILD.bazel b/e2e/packages/BUILD.bazel
index 8af7845a75..d523fd3f82 100644
--- a/e2e/packages/BUILD.bazel
+++ b/e2e/packages/BUILD.bazel
@@ -40,6 +40,8 @@ nodejs_test(
     node_modules = "@e2e_packages_npm_install_duplicate_for_determinism_testing//:node_modules",
     # TODO(gregmagolan): fix this test on windows
     tags = ["fix-windows"],
+    # TODO: use runfiles
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 nodejs_test(
@@ -52,4 +54,6 @@ nodejs_test(
     node_modules = "@e2e_packages_yarn_install_duplicate_for_determinism_testing//:node_modules",
     # TODO(gregmagolan): fix this test on windows
     tags = ["fix-windows"],
+    # TODO: use runfiles
+    templated_args = ["--bazel_patch_module_resolver"],
 )
diff --git a/e2e/typescript/BUILD.bazel b/e2e/typescript/BUILD.bazel
index 27c9d8faae..9f225bd1ca 100644
--- a/e2e/typescript/BUILD.bazel
+++ b/e2e/typescript/BUILD.bazel
@@ -51,6 +51,10 @@ jasmine_node_test(
         # Verify that worker_protocol.proto can be referenced as a target in the generated npm bazel workspace
         "@npm//@bazel/typescript/third_party/github.com/bazelbuild/bazel/src/main/protobuf:worker_protocol.proto",
     ],
+    templated_args = [
+        # ts_library produces named AMD output with repo name in the require statement
+        "--bazel_patch_module_resolver",
+    ],
     deps = [
         ":test_lib",
     ],
diff --git a/e2e/webapp/test.js b/e2e/webapp/test.js
index c8c8d64272..14b0c57f06 100644
--- a/e2e/webapp/test.js
+++ b/e2e/webapp/test.js
@@ -1,5 +1,6 @@
 const fs = require('fs');
-const content = fs.readFileSync(require.resolve('e2e_webapp/out.min/app.js'), 'utf-8');
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
+const content = fs.readFileSync(runfiles.resolve('e2e_webapp/out.min/app.js'), 'utf-8');
 if (content.indexOf('import("./strings') < 0) {
   console.error(content);
   process.exitCode = 1;
diff --git a/examples/angular/WORKSPACE b/examples/angular/WORKSPACE
index 1a91a10a9c..c000a59994 100644
--- a/examples/angular/WORKSPACE
+++ b/examples/angular/WORKSPACE
@@ -36,6 +36,8 @@ http_archive(
 # Fetch sass rules for compiling sass files
 http_archive(
     name = "io_bazel_rules_sass",
+    patch_args = ["-p1"],
+    patches = ["@build_bazel_rules_nodejs//:rules_sass.pr126.patch"],
     sha256 = "c78be58f5e0a29a04686b628cf54faaee0094322ae0ac99da5a8a8afca59a647",
     strip_prefix = "rules_sass-1.25.0",
     urls = [
diff --git a/examples/angular/tools/BUILD.bazel b/examples/angular/tools/BUILD.bazel
index d2f335e89b..43fc2cdc90 100644
--- a/examples/angular/tools/BUILD.bazel
+++ b/examples/angular/tools/BUILD.bazel
@@ -11,5 +11,7 @@ nodejs_binary(
         "@npm//@bazel/typescript",
     ],
     entry_point = "@npm//:node_modules/@bazel/typescript/internal/tsc_wrapped/tsc_wrapped.js",
+    # TODO: turn on --worker_sandboxing and remove this flag to see failure to load the plugin
+    templated_args = ["--bazel_patch_module_resolver"],
     visibility = ["//:__subpackages__"],
 )
diff --git a/examples/angular_view_engine/WORKSPACE b/examples/angular_view_engine/WORKSPACE
index 81eeaf77aa..a58e290f7c 100644
--- a/examples/angular_view_engine/WORKSPACE
+++ b/examples/angular_view_engine/WORKSPACE
@@ -23,6 +23,8 @@ http_archive(
 # Fetch sass rules for compiling sass files
 http_archive(
     name = "io_bazel_rules_sass",
+    patch_args = ["-p1"],
+    patches = ["@build_bazel_rules_nodejs//:rules_sass.pr126.patch"],
     sha256 = "c78be58f5e0a29a04686b628cf54faaee0094322ae0ac99da5a8a8afca59a647",
     strip_prefix = "rules_sass-1.25.0",
     urls = [
diff --git a/examples/kotlin/BUILD.bazel b/examples/kotlin/BUILD.bazel
index db45b11943..9d211cd257 100644
--- a/examples/kotlin/BUILD.bazel
+++ b/examples/kotlin/BUILD.bazel
@@ -74,5 +74,9 @@ jasmine_node_test(
         ":bundle",
         "@npm//domino",
     ],
-    templated_args = ["--node_options=--experimental-modules"],
+    templated_args = [
+        # TODO: don't rely on patching require()
+        "--bazel_patch_module_resolver",
+        "--node_options=--experimental-modules",
+    ],
 )
diff --git a/examples/user_managed_deps/BUILD.bazel b/examples/user_managed_deps/BUILD.bazel
index 808b886076..19806397fa 100644
--- a/examples/user_managed_deps/BUILD.bazel
+++ b/examples/user_managed_deps/BUILD.bazel
@@ -43,6 +43,8 @@ jasmine_node_test(
     srcs = glob(["*.spec.js"]),
     node_modules = "//:node_modules",
     tags = ["no-local-jasmine-deps"],
+    # user-managed deps don't expose the provider the linker needs to make require work
+    templated_args = ["--bazel_patch_module_resolver"],
     deps = [
         ":decrement",
         ":program",
diff --git a/internal/bazel_integration_test/test_runner.js b/internal/bazel_integration_test/test_runner.js
index 03f1e52e0c..70f205dbbe 100644
--- a/internal/bazel_integration_test/test_runner.js
+++ b/internal/bazel_integration_test/test_runner.js
@@ -23,7 +23,7 @@ const spawnSync = require('child_process').spawnSync;
 const fs = require('fs');
 const path = require('path');
 const tmp = require('tmp');
-
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
 const DEBUG = !!process.env['BAZEL_INTEGRATION_TEST_DEBUG'];
 const VERBOSE_LOGS = !!process.env['VERBOSE_LOGS'];
 
@@ -189,7 +189,7 @@ if (bazelrcImportsKeys.length && isFile(bazelrcFile)) {
   let bazelrcContents = fs.readFileSync(bazelrcFile, {encoding: 'utf-8'});
   for (const importKey of bazelrcImportsKeys) {
     const importContents =
-        fs.readFileSync(require.resolve(config.bazelrcImports[importKey]), {encoding: 'utf-8'});
+        fs.readFileSync(runfiles.resolve(config.bazelrcImports[importKey]), {encoding: 'utf-8'});
     bazelrcContents = bazelrcContents.replace(importKey, importContents);
   }
   fs.writeFileSync(bazelrcFile, bazelrcContents);
@@ -212,7 +212,7 @@ if (config.bazelrcAppend) {
   let workspaceContents = fs.readFileSync(workspaceFile, {encoding: 'utf-8'});
   // replace repositories
   for (const repositoryKey of Object.keys(config.repositories)) {
-    const archiveFile = require.resolve(config.repositories[repositoryKey]).replace(/\\/g, '/');
+    const archiveFile = runfiles.resolve(config.repositories[repositoryKey]).replace(/\\/g, '/');
     const regex =
         new RegExp(`(local_repository|http_archive|git_repository)\\(\\s*name\\s*\\=\\s*"${
             repositoryKey}"[^)]+`);
@@ -281,7 +281,7 @@ if (isFile(packageJsonFile)) {
 
 const isWindows = process.platform === 'win32';
 const bazelBinary =
-    require.resolve(`${config.bazelBinaryWorkspace}/bazel${isWindows ? '.exe' : ''}`);
+    runfiles.resolve(`${config.bazelBinaryWorkspace}/bazel${isWindows ? '.exe' : ''}`);
 
 if (DEBUG) {
   log(`
diff --git a/internal/check_bazel_version.js b/internal/check_bazel_version.js
index 534a26e5cf..78cc81fc68 100644
--- a/internal/check_bazel_version.js
+++ b/internal/check_bazel_version.js
@@ -16,15 +16,16 @@
  */
 'use strict';
 
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
 const fs = require('fs');
 const args = process.argv.slice(2);
 
 const BAZEL_VERSION = args[0];
 
 const version =
-    fs.readFileSync(require.resolve('build_bazel_rules_nodejs/.bazelversion'), 'utf-8').trim();
+    fs.readFileSync(runfiles.resolve('build_bazel_rules_nodejs/.bazelversion'), 'utf-8').trim();
 const bazelci_version =
-    fs.readFileSync(require.resolve('build_bazel_rules_nodejs/.bazelci/presubmit.yml'), 'utf-8')
+    fs.readFileSync(runfiles.resolve('build_bazel_rules_nodejs/.bazelci/presubmit.yml'), 'utf-8')
         .split('\n')
         .find(v => v.startsWith('bazel:'));
 
diff --git a/internal/node/launcher.sh b/internal/node/launcher.sh
index 10efb6c4e6..7fdec0d188 100644
--- a/internal/node/launcher.sh
+++ b/internal/node/launcher.sh
@@ -179,8 +179,7 @@ EXIT_CODE_CAPTURE=""
 
 RUN_LINKER=true
 NODE_PATCHES=true
-# TODO(alex): change the default to false
-PATCH_REQUIRE=true
+PATCH_REQUIRE=false
 for ARG in ${ALL_ARGS[@]+"${ALL_ARGS[@]}"}; do
   case "$ARG" in
     # Supply custom linker arguments for first-party dependencies
@@ -193,15 +192,16 @@ for ARG in ${ALL_ARGS[@]+"${ALL_ARGS[@]}"}; do
     --bazel_capture_exit_code=*) EXIT_CODE_CAPTURE="${ARG#--bazel_capture_exit_code=}" ;;
     # Disable the node_loader.js monkey patches for require()
     # Note that this means you need an explicit runfiles helper library
+    # This flag is now a no-op since the default is also false
     --nobazel_patch_module_resolver) PATCH_REQUIRE=false ;;
     # Enable the node_loader.js monkey patches for require()
-    # Currently a no-op, but specifying this makes the behavior unchanged when we update
-    # the default for PATCH_REQUIRE above
     --bazel_patch_module_resolver) PATCH_REQUIRE=true ;;
     # Disable the --require node-patches (undocumented and unused; only here as an escape value)
     --nobazel_node_patches) NODE_PATCHES=false ;;
     # Disable the linker pre-process (undocumented and unused; only here as an escape value)
-    --nobazel_run_linker) RUN_LINKER=false ;;
+    # It also enables the --bazel_patch_module_resolver flag, as either the linker or require() patch
+    # is needed for resolving third-party node modules.
+    --nobazel_run_linker) RUN_LINKER=false PATCH_REQUIRE=true ;;
     # Let users pass through arguments to node itself
     --node_options=*) USER_NODE_OPTIONS+=( "${ARG#--node_options=}" ) ;;
     # Remaining argv is collected to pass to the program
diff --git a/internal/node/test/BUILD.bazel b/internal/node/test/BUILD.bazel
index 6c1d0398a3..ea1c999313 100644
--- a/internal/node/test/BUILD.bazel
+++ b/internal/node/test/BUILD.bazel
@@ -16,12 +16,13 @@ nodejs_binary(
 )
 
 # You can have a nodejs_binary with a node_modules attribute
-# and no fine grained deps
+# and no fine grained deps, but it requires patching the module resolver
 nodejs_binary(
     name = "has_deps_legacy",
     data = ["has-deps.js"],
     entry_point = ":has-deps.js",
     node_modules = "@fine_grained_deps_yarn//:node_modules",
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 # You can have a nodejs_binary with no node_modules attribute
@@ -101,6 +102,8 @@ nodejs_test(
         "@npm//node_resolve_nested_main",
     ],
     entry_point = ":module_resolution.spec.js",
+    # this is a test for the patched module resolver
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 nodejs_test(
@@ -218,6 +221,8 @@ nodejs_test(
         "@npm//node_resolve_nested_main",
     ],
     entry_point = ":module_resolution_built.spec.js",
+    # TODO: passes locally without this flag but fails on CircleCI
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 nodejs_test(
@@ -227,6 +232,8 @@ nodejs_test(
         ":genfile-runfile",
     ],
     entry_point = ":data_resolution_built.spec.js",
+    # TODO: fails on Windows without this flag
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 npm_package_bin(
diff --git a/internal/node/test/binary_as_data/BUILD.bazel b/internal/node/test/binary_as_data/BUILD.bazel
index 2220436925..f695d4dce5 100644
--- a/internal/node/test/binary_as_data/BUILD.bazel
+++ b/internal/node/test/binary_as_data/BUILD.bazel
@@ -9,4 +9,6 @@ nodejs_test(
     name = "main_bin_data_test",
     data = [":main_bin"],
     entry_point = "test.js",
+    # TODO: fails on Windows without this flag
+    templated_args = ["--bazel_patch_module_resolver"],
 )
diff --git a/internal/npm_install/BUILD.bazel b/internal/npm_install/BUILD.bazel
index f138dc7c74..350ad6af64 100644
--- a/internal/npm_install/BUILD.bazel
+++ b/internal/npm_install/BUILD.bazel
@@ -56,5 +56,7 @@ nodejs_binary(
         "//third_party/npm/node_modules/named-amd",
     ],
     entry_point = ":browserify-wrapped.js",
+    # TODO: figure out why browserify isn't resolved properly
+    templated_args = ["--bazel_patch_module_resolver"],
     visibility = ["//visibility:public"],
 )
diff --git a/internal/npm_install/test/BUILD.bazel b/internal/npm_install/test/BUILD.bazel
index 286295f9f9..b6f257cdd4 100644
--- a/internal/npm_install/test/BUILD.bazel
+++ b/internal/npm_install/test/BUILD.bazel
@@ -18,6 +18,9 @@ jasmine_node_test(
         "@fine_grained_goldens//:golden_files",
         "@npm//unidiff",
     ],
+    # Depends on having the .js file in source tree but resolve relative paths
+    # to .js files in the output tree
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 nodejs_binary(
@@ -103,6 +106,8 @@ sh_test(
     ],
     node_modules = "@fine_grained_deps_%s//:node_modules" % pkgmgr,
     tags = ["no-local-jasmine-deps"],
+    # TODO: get this test running with just linker: failing under --config=no-runfiles
+    templated_args = ["--bazel_patch_module_resolver"],
     deps = [
         "@fine_grained_deps_%s//jasmine" % pkgmgr,
         "@fine_grained_deps_%s//jasmine-core" % pkgmgr,
@@ -122,6 +127,8 @@ sh_test(
         "fine.spec.js",
     ],
     tags = ["no-local-jasmine-deps"],
+    # TODO: get this test running with just linker: failing under --config=no-runfiles
+    templated_args = ["--bazel_patch_module_resolver"],
     deps = [
         "@fine_grained_deps_%s//jasmine" % pkgmgr,
         "@fine_grained_deps_%s//jasmine-core" % pkgmgr,
diff --git a/internal/npm_install/test/browserify.spec.js b/internal/npm_install/test/browserify.spec.js
index a930edf306..747c9fb094 100644
--- a/internal/npm_install/test/browserify.spec.js
+++ b/internal/npm_install/test/browserify.spec.js
@@ -1,7 +1,9 @@
 const fs = require('fs');
 const path = require('path');
-const mainFile = 'build_bazel_rules_nodejs/third_party/npm/node_modules/browserify/index.js';
-const directory = 'build_bazel_rules_nodejs/internal/npm_install/test';
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
+const mainFile =
+    runfiles.resolve('build_bazel_rules_nodejs/third_party/npm/node_modules/browserify/index.js');
+const directory = runfiles.resolve('build_bazel_rules_nodejs/internal/npm_install/test');
 
 describe('our bundled, vendored browserify binary', () => {
   it('should preserve licenses', () => {
diff --git a/internal/npm_install/test/check.js b/internal/npm_install/test/check.js
index 22e00fad46..919f80aea1 100644
--- a/internal/npm_install/test/check.js
+++ b/internal/npm_install/test/check.js
@@ -1,11 +1,12 @@
 const fs = require('fs');
 const path = require('path');
-const unidiff = require('unidiff')
+const unidiff = require('unidiff');
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
 
 function check(file, updateGolden = false) {
   // Strip comments from generated file for comparison to golden
   // to make comparison less brittle
-  const actual = require.resolve(path.posix.join('fine_grained_goldens', file));
+  const actual = runfiles.resolve(path.posix.join('fine_grained_goldens', file));
   const actualContents =
       fs.readFileSync(actual, {encoding: 'utf-8'})
           .replace(/\r\n/g, '\n')
@@ -18,7 +19,7 @@ function check(file, updateGolden = false) {
           .replace(/[\n]+/g, '\n');
 
   // Load the golden file for comparison
-  const golden = require.resolve('./golden/' + file + '.golden');
+  const golden = runfiles.resolvePackageRelative('./golden/' + file + '.golden');
 
   if (updateGolden) {
     // Write to golden file
diff --git a/internal/pkg_npm/BUILD.bazel b/internal/pkg_npm/BUILD.bazel
index ea0addbeb3..0c89f44efa 100644
--- a/internal/pkg_npm/BUILD.bazel
+++ b/internal/pkg_npm/BUILD.bazel
@@ -16,6 +16,8 @@ nodejs_binary(
     name = "packager",
     data = ["//third_party/github.com/gjtorikian/isBinaryFile"],
     entry_point = ":packager.js",
+    # TODO: figure out why isbinaryfile is not linked in a way this can resolve
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 nodejs_binary(
diff --git a/internal/pkg_web/BUILD.bazel b/internal/pkg_web/BUILD.bazel
index b0cfabca5e..96ae3e746c 100644
--- a/internal/pkg_web/BUILD.bazel
+++ b/internal/pkg_web/BUILD.bazel
@@ -27,12 +27,16 @@ nodejs_binary(
     ],
     entry_point = ":assembler.js",
     node_modules = ":node_modules_none",
+    # TODO: figure out why isbinaryfile isn't resolved properly
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 # BEGIN-INTERNAL
 jasmine_node_test(
     name = "assembler_test",
     srcs = ["assembler_spec.js"],
+    # TODO: figure out why isbinaryfile isn't resolved properly
+    templated_args = ["--bazel_patch_module_resolver"],
     deps = [
         "assembler.js",
         "//third_party/github.com/gjtorikian/isBinaryFile",
diff --git a/internal/pkg_web/test2/spec.js b/internal/pkg_web/test2/spec.js
index 4022c4c881..a86a4e7472 100644
--- a/internal/pkg_web/test2/spec.js
+++ b/internal/pkg_web/test2/spec.js
@@ -1,14 +1,13 @@
 const fs = require('fs');
 const path = require('path');
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
 
-process.chdir(path.join(process.env['TEST_SRCDIR'], 'build_bazel_rules_nodejs'));
-console.error(fs.readdirSync('.'));
 describe('pkg_web paths', () => {
   it('should match the golden file', () => {
     const output = 'build_bazel_rules_nodejs/internal/pkg_web/test2/pkg/index.html';
     const golden = 'build_bazel_rules_nodejs/internal/pkg_web/test2/index_golden.html_';
-    const actual = fs.readFileSync(require.resolve(output), {encoding: 'utf-8'});
-    const expected = fs.readFileSync(require.resolve(golden), {encoding: 'utf-8'});
+    const actual = fs.readFileSync(runfiles.resolve(output), {encoding: 'utf-8'});
+    const expected = fs.readFileSync(runfiles.resolve(golden), {encoding: 'utf-8'});
     // make the input hermetic by replacing the cache-buster timestamp
     expect(actual.replace(/\?v=\d+/g, '?v=123').trim()).toBe(expected.trim());
   });
diff --git a/package.bzl b/package.bzl
index 3ca9f39cc3..6d0ee3ebb6 100644
--- a/package.bzl
+++ b/package.bzl
@@ -31,11 +31,13 @@ def rules_nodejs_dev_dependencies():
     _maybe(
         http_archive,
         name = "io_bazel_rules_sass",
-        sha256 = "c78be58f5e0a29a04686b628cf54faaee0094322ae0ac99da5a8a8afca59a647",
-        strip_prefix = "rules_sass-1.25.0",
+        patch_args = ["-p1"],
+        patches = ["//:rules_sass.pr126.patch"],
+        sha256 = "cf28ff1bcfafb3c97f138bbc8ca9fe386e968ed3faaa9f8e6214abb5e88a2ecd",
+        strip_prefix = "rules_sass-1.29.0",
         urls = [
-            "https://github.com/bazelbuild/rules_sass/archive/1.25.0.zip",
-            "https://mirror.bazel.build/github.com/bazelbuild/rules_sass/archive/1.25.0.zip",
+            "https://github.com/bazelbuild/rules_sass/archive/1.29.0.zip",
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_sass/archive/1.29.0.zip",
         ],
     )
 
diff --git a/packages/concatjs/web_test/test/karma_typescript/user_files.spec.js b/packages/concatjs/web_test/test/karma_typescript/user_files.spec.js
index 2cf0ef40eb..342ef42002 100644
--- a/packages/concatjs/web_test/test/karma_typescript/user_files.spec.js
+++ b/packages/concatjs/web_test/test/karma_typescript/user_files.spec.js
@@ -1,11 +1,12 @@
 const fs = require('fs');
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
 
 describe('karma_web_test_suite', () => {
   let config;
 
   beforeAll(() => {
     config = fs.readFileSync(
-        require.resolve(
+        runfiles.resolve(
             'build_bazel_rules_nodejs/packages/concatjs/web_test/test/karma_typescript/testing_wrapped_test.conf.js'),
         'utf-8');
   });
diff --git a/packages/create/test.js b/packages/create/test.js
index 105d69c9f7..851c13aa4d 100644
--- a/packages/create/test.js
+++ b/packages/create/test.js
@@ -2,7 +2,8 @@
  * Simple node program to test that workspace creation works.
  * We don't use a test framework here since dependencies are awkward.
  */
-const pkg = 'build_bazel_rules_nodejs/packages/create/npm_package';
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
+const pkg = runfiles.resolve('build_bazel_rules_nodejs/packages/create/npm_package');
 const fs = require('fs');
 const {main} = require(pkg);
 
diff --git a/packages/jasmine/test/BUILD.bazel b/packages/jasmine/test/BUILD.bazel
index 3799b50059..32651ba43b 100644
--- a/packages/jasmine/test/BUILD.bazel
+++ b/packages/jasmine/test/BUILD.bazel
@@ -46,6 +46,8 @@ jasmine_node_test(
     # Use the generated_require.spec.js from the output tree
     srcs = [":generated_require_spec"],
     data = ["test.json"],
+    # TODO: fails under --config=no-runfiles without this flag
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 copy_to_bin(
@@ -118,6 +120,8 @@ jasmine_node_test(
         "coverage.spec.js",
         ":coverage_test_srcs",
     ],
+    # TODO: fails under --config=no-runfiles without this flag
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 jasmine_node_test(
@@ -127,6 +131,8 @@ jasmine_node_test(
         "dynamic_import.js",
     ],
     args = [
+        # TODO: investigate why this fails without the patched require() function
+        "--bazel_patch_module_resolver",
         # the --node_options arg will be consumed by the node launcher
         "--node_options=--experimental-modules",
         # the remaining args should be passed to the spec
@@ -147,6 +153,8 @@ jasmine_node_test(
         "arg3",
     ],
     templated_args = [
+        # TODO: investigate why this fails without the patched require() function
+        "--bazel_patch_module_resolver",
         # the --node_options templated arg will be consumed by the node launcher
         "--node_options=--experimental-modules",
         # the remaining args should be passed to the spec
diff --git a/packages/labs/grpc_web/BUILD.bazel b/packages/labs/grpc_web/BUILD.bazel
index a182bd1407..5539f11aec 100644
--- a/packages/labs/grpc_web/BUILD.bazel
+++ b/packages/labs/grpc_web/BUILD.bazel
@@ -15,6 +15,8 @@ nodejs_binary(
     name = "change_import_style",
     entry_point = ":change_import_style.js",
     node_modules = "@build_bazel_rules_typescript_grpc_web_compiletime_deps//:node_modules",
+    # TODO: figure out why this doesn't resolve minimist
+    templated_args = ["--bazel_patch_module_resolver"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/packages/labs/test/grpc_web/BUILD.bazel b/packages/labs/test/grpc_web/BUILD.bazel
index d69bde0f8d..e683142e3d 100644
--- a/packages/labs/test/grpc_web/BUILD.bazel
+++ b/packages/labs/test/grpc_web/BUILD.bazel
@@ -10,6 +10,8 @@ jasmine_node_test(
         "@npm//google-protobuf",
         "@npm//grpc-web",
     ],
+    # TODO: make the test work with generated protobuf code that isn't runfiles-aware
+    templated_args = ["--bazel_patch_module_resolver"],
     deps = [
         ":commonjs_test_lib",
     ],
diff --git a/packages/labs/test/protobufjs/BUILD.bazel b/packages/labs/test/protobufjs/BUILD.bazel
index 28b9802a17..8271540814 100644
--- a/packages/labs/test/protobufjs/BUILD.bazel
+++ b/packages/labs/test/protobufjs/BUILD.bazel
@@ -9,6 +9,7 @@ ts_library(
     deps = [
         ":test_ts_proto",
         "@npm//@types/jasmine",
+        "@npm//@types/node",
     ],
 )
 
diff --git a/packages/labs/test/protobufjs/test.ts b/packages/labs/test/protobufjs/test.ts
index d9d80f5360..78deddced9 100644
--- a/packages/labs/test/protobufjs/test.ts
+++ b/packages/labs/test/protobufjs/test.ts
@@ -1,4 +1,5 @@
-import {TestMessage} from 'build_bazel_rules_nodejs/packages/labs/test/protobufjs/test_ts_proto';
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']!);
+const {TestMessage} = require(runfiles.resolvePackageRelative('test_ts_proto.js'));
 
 describe('protobufjs', () => {
   it('should work in node', () => {
diff --git a/packages/node-patches/BUILD.bazel b/packages/node-patches/BUILD.bazel
index cb392adbdf..69d188f615 100644
--- a/packages/node-patches/BUILD.bazel
+++ b/packages/node-patches/BUILD.bazel
@@ -60,7 +60,11 @@ nodejs_test(
     ],
     entry_point = "@npm_node_patches//:node_modules/mocha/bin/mocha",
     tags = ["fix-windows"],
-    templated_args = ["$$(rlocation $(rootpath %s))" % s for s in test_js] + ["--nobazel_node_patches"],
+    templated_args = ["$$(rlocation $(rootpath %s))" % s for s in test_js] + [
+        # TODO: passes locally on mac without this flag but fails on CircleCI
+        "--bazel_patch_module_resolver",
+        "--nobazel_node_patches",
+    ],
 )
 
 rollup_bundle(
diff --git a/packages/protractor/BUILD.bazel b/packages/protractor/BUILD.bazel
index b19836d832..7a2ee6f905 100644
--- a/packages/protractor/BUILD.bazel
+++ b/packages/protractor/BUILD.bazel
@@ -62,7 +62,8 @@ nodejs_test(
 ts_library(
     name = "protractor",
     srcs = ["protractor-utils.ts"],
-    module_name = "@bazel/protractor/protractor-utils",
+    data = ["package.json"],
+    module_name = "@bazel/protractor",
     module_root = "protractor-utils",
     deps = ["@npm//@types/node"],
 )
diff --git a/packages/protractor/package.json b/packages/protractor/package.json
index e0a470b148..bf4a6d0843 100644
--- a/packages/protractor/package.json
+++ b/packages/protractor/package.json
@@ -15,10 +15,11 @@
       "protractor",
       "bazel"
   ],
+  "main": "protractor-utils.js",
   "peerDependencies": {
       "protractor": ">=5.0.0"
   },
   "scripts": {
     "postinstall": "node npm_version_check.js"
   }
-}
\ No newline at end of file
+}
diff --git a/packages/protractor/protractor-utils.ts b/packages/protractor/protractor-utils.ts
index 427197851b..16e2322eb4 100644
--- a/packages/protractor/protractor-utils.ts
+++ b/packages/protractor/protractor-utils.ts
@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']!);
 import * as child_process from 'child_process';
 import * as net from 'net';
 
@@ -98,7 +99,7 @@ export interface ServerSpec {
 export async function runServer(
     workspace: string, serverTarget: string, portFlag: string, serverArgs: string[],
     timeout = 5000): Promise<ServerSpec> {
-  const serverPath = require.resolve(`${workspace}/${serverTarget}`);
+  const serverPath = runfiles.resolve(`${workspace}/${serverTarget}`);
   const port = await findFreeTcpPort();
 
   // Start the Bazel server binary with a random free TCP port.
diff --git a/packages/protractor/protractor.conf.js b/packages/protractor/protractor.conf.js
index 6726f5610c..897cf48f90 100644
--- a/packages/protractor/protractor.conf.js
+++ b/packages/protractor/protractor.conf.js
@@ -14,6 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
 const path = require('path');
 
 function log_verbose(...m) {
@@ -76,7 +77,7 @@ let conf = {};
 
 // Import the user's base protractor configuration if specified
 if (configPath) {
-  const baseConf = require(configPath);
+  const baseConf = require(runfiles.resolve(configPath));
   if (!baseConf.config) {
     throw new Error('Invalid base protractor configuration. Expected config to be exported.');
   }
@@ -86,7 +87,7 @@ if (configPath) {
 
 // Import the user's on prepare function if specified
 if (onPreparePath) {
-  const onPrepare = require(onPreparePath);
+  const onPrepare = require(runfiles.resolve(onPreparePath));
   if (typeof onPrepare === 'function') {
     const original = conf.onPrepare;
     conf.onPrepare = function() {
@@ -104,7 +105,7 @@ if (onPreparePath) {
 setConf(conf, 'framework', 'jasmine2', 'is set to jasmine2');
 
 const specs =
-    [TMPL_specs].map(s => require.resolve(s)).filter(s => /(\b|_)(spec|test)\.js$/.test(s));
+    [TMPL_specs].map(s => runfiles.resolve(s)).filter(s => /(\b|_)(spec|test)\.js$/.test(s));
 
 setConf(conf, 'specs', specs, 'are determined by the srcs and deps attribute');
 
@@ -112,7 +113,7 @@ setConf(conf, 'specs', specs, 'are determined by the srcs and deps attribute');
 // of the browsers attribute passed to karma_web_test_suite
 // We setup the protractor configuration based on the values in this object
 if (process.env['WEB_TEST_METADATA']) {
-  const webTestMetadata = require(process.env['WEB_TEST_METADATA']);
+  const webTestMetadata = require(runfiles.resolve(process.env['WEB_TEST_METADATA']));
   log_verbose(`WEB_TEST_METADATA: ${JSON.stringify(webTestMetadata, null, 2)}`);
   if (webTestMetadata['environment'] === 'local') {
     // When a local chrome or firefox browser is chosen such as
@@ -123,8 +124,8 @@ if (process.env['WEB_TEST_METADATA']) {
     const webTestNamedFiles = webTestMetadata['webTestFiles'][0]['namedFiles'];
     const headless = !process.env['DISPLAY'];
     if (webTestNamedFiles['CHROMIUM']) {
-      const chromeBin = require.resolve(webTestNamedFiles['CHROMIUM']);
-      const chromeDriver = require.resolve(webTestNamedFiles['CHROMEDRIVER']);
+      const chromeBin = runfiles.resolve(webTestNamedFiles['CHROMIUM']);
+      const chromeDriver = runfiles.resolve(webTestNamedFiles['CHROMEDRIVER']);
 
       // The sandbox needs to be disabled, because it causes Chrome to crash on some environments.
       // See: http://chromedriver.chromium.org/help/chrome-doesn-t-start
@@ -146,7 +147,7 @@ if (process.env['WEB_TEST_METADATA']) {
       // TODO(gmagolan): implement firefox support for protractor
       throw new Error('Firefox not yet support by protractor_web_test_suite');
 
-      // const firefoxBin = require.resolve(webTestNamedFiles['FIREFOX'])
+      // const firefoxBin = runfiles.resolve(webTestNamedFiles['FIREFOX'])
       // const args = [];
       // if (headless) {
       //   args.push("--headless")
diff --git a/packages/protractor/protractor_web_test.bzl b/packages/protractor/protractor_web_test.bzl
index 7639822a1f..5d150fae26 100644
--- a/packages/protractor/protractor_web_test.bzl
+++ b/packages/protractor/protractor_web_test.bzl
@@ -261,6 +261,8 @@ def protractor_web_test(
         entry_point = Label(protractor_entry_point),
         data = srcs + deps + data + [Label(d) for d in peer_deps],
         testonly = 1,
+        # TODO: make protractor binary not depend on monkey-patched require()
+        templated_args = ["--bazel_patch_module_resolver"],
         visibility = ["//visibility:private"],
     )
 
diff --git a/packages/protractor/test/protractor-2/on-prepare.js b/packages/protractor/test/protractor-2/on-prepare.js
index e2706c844c..a2bc3437b1 100644
--- a/packages/protractor/test/protractor-2/on-prepare.js
+++ b/packages/protractor/test/protractor-2/on-prepare.js
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-const protractorUtils = require('@bazel/protractor/protractor-utils');
+const protractorUtils = require('@bazel/protractor');
 const protractor = require('protractor');
 const path = require('path');
 
diff --git a/packages/protractor/test/protractor-utils/BUILD.bazel b/packages/protractor/test/protractor-utils/BUILD.bazel
index 0677e3e08a..e1a1b04ebc 100644
--- a/packages/protractor/test/protractor-utils/BUILD.bazel
+++ b/packages/protractor/test/protractor-utils/BUILD.bazel
@@ -28,5 +28,8 @@ jasmine_node_test(
     srcs = [":protractor_utils_tests_lib"],
     data = [
         ":fake-devserver",
+        "//packages/protractor",
     ],
+    # TODO: fails under --config=no-runfiles without this flag
+    templated_args = ["--bazel_patch_module_resolver"],
 )
diff --git a/packages/protractor/test/protractor-utils/index_test.ts b/packages/protractor/test/protractor-utils/index_test.ts
index a765b1d730..0abfcd7a38 100644
--- a/packages/protractor/test/protractor-utils/index_test.ts
+++ b/packages/protractor/test/protractor-utils/index_test.ts
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-import {runServer} from '@bazel/protractor/protractor-utils';
+import {runServer} from '@bazel/protractor';
 
 describe('Bazel protractor utils', () => {
   it('should be able to start devserver', async () => {
diff --git a/packages/protractor/test/protractor/conf.ts b/packages/protractor/test/protractor/conf.ts
index 3b7c953249..b055ace9d3 100644
--- a/packages/protractor/test/protractor/conf.ts
+++ b/packages/protractor/test/protractor/conf.ts
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-import * as protractorUtils from '@bazel/protractor/protractor-utils';
+import * as protractorUtils from '@bazel/protractor';
 import {browser} from 'protractor';
 
 const http = require('http');
diff --git a/packages/terser/test/directory-args.spec.js b/packages/terser/test/directory-args.spec.js
index 9df530f3c0..fff58edf60 100644
--- a/packages/terser/test/directory-args.spec.js
+++ b/packages/terser/test/directory-args.spec.js
@@ -1,4 +1,6 @@
-const {directoryArgs} = require('build_bazel_rules_nodejs/packages/terser/index')
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
+const {directoryArgs} =
+    require(runfiles.resolve('build_bazel_rules_nodejs/packages/terser/index.js'));
 const fs = require('fs');
 const path = require('path');
 const tmp = require('tmp');
@@ -43,4 +45,4 @@ describe('directoryArgs', () => {
       '--keep-fnames',
     ]);
   });
-})
\ No newline at end of file
+})
diff --git a/packages/terser/test/exec/spec.js b/packages/terser/test/exec/spec.js
index 599ced10c0..3d4ca63974 100644
--- a/packages/terser/test/exec/spec.js
+++ b/packages/terser/test/exec/spec.js
@@ -2,8 +2,8 @@ const fs = require('fs');
 const cp = require('child_process');
 const util = require('util');
 const assert = require('assert');
-
-const terserWrap = require.resolve('build_bazel_rules_nodejs/packages/terser/index.js');
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
+const terserWrap = runfiles.resolve('build_bazel_rules_nodejs/packages/terser/index.js');
 
 if (!fs.existsSync(terserWrap)) {
   throw new Error(
diff --git a/packages/terser/test/sourcemap/terser_spec.js b/packages/terser/test/sourcemap/terser_spec.js
index dd788d22a0..4aa41135b2 100644
--- a/packages/terser/test/sourcemap/terser_spec.js
+++ b/packages/terser/test/sourcemap/terser_spec.js
@@ -1,10 +1,11 @@
 const fs = require('fs');
 const sm = require('source-map');
+const runfiles = require(process.env['BAZEL_NODE_RUNFILES_HELPER']);
 const DIR = 'build_bazel_rules_nodejs/packages/terser/test/sourcemap';
 
 describe('terser sourcemap handling', () => {
   it('should produce a sourcemap output', async () => {
-    const file = require.resolve(DIR + '/src1.min.js.map');
+    const file = runfiles.resolve(DIR + '/src1.min.js.map');
     const debugBuild = /\/bazel-out\/[^/\s]*-dbg\//.test(file);
     const rawSourceMap = JSON.parse(fs.readFileSync(file, 'utf-8'));
     await sm.SourceMapConsumer.with(rawSourceMap, null, consumer => {
@@ -18,4 +19,4 @@ describe('terser sourcemap handling', () => {
       expect(pos.name).toBe('MyClass');
     });
   });
-});
\ No newline at end of file
+});
diff --git a/packages/typescript/test/angular_plugin/BUILD.bazel b/packages/typescript/test/angular_plugin/BUILD.bazel
new file mode 100644
index 0000000000..c11ad87ad7
--- /dev/null
+++ b/packages/typescript/test/angular_plugin/BUILD.bazel
@@ -0,0 +1,23 @@
+load("@build_bazel_rules_nodejs//:index.bzl", "nodejs_binary")
+
+# Custom ts_library compiler that runs tsc_wrapped with angular/compiler-cli statically linked
+# This can be used with worker mode because we don't need the linker at runtime to make
+# the angular plugin loadable
+# Just a clone of @build_bazel_rules_typescript//internal:tsc_wrapped with added deps
+nodejs_binary(
+    name = "tsc_wrapped_with_angular",
+    data = [
+        "@build_bazel_rules_typescript//internal:tsc_wrapped",
+        "@build_bazel_rules_typescript//third_party/github.com/bazelbuild/bazel/src/main/protobuf:worker_protocol.proto",
+        "@npm//@angular/compiler-cli",
+        "@npm//protobufjs",
+        "@npm//source-map-support",
+        "@npm//tsickle",
+        "@npm//tsutils",
+        "@npm//typescript",
+    ],
+    entry_point = "@build_bazel_rules_typescript//internal:tsc_wrapped/tsc_wrapped.js",
+    # TODO: turn on --worker_sandboxing and remove this flag to see failure to load the plugin
+    templated_args = ["--bazel_patch_module_resolver"],
+    visibility = ["//packages/typescript/test/angular_plugin:__subpackages__"],
+)
diff --git a/packages/typescript/test/angular_plugin/compiled_output/BUILD.bazel b/packages/typescript/test/angular_plugin/compiled_output/BUILD.bazel
index 065b964d27..cbb73041cb 100644
--- a/packages/typescript/test/angular_plugin/compiled_output/BUILD.bazel
+++ b/packages/typescript/test/angular_plugin/compiled_output/BUILD.bazel
@@ -21,11 +21,10 @@ ts_library(
     angular_assets = [
         "comp.ng.html",
     ],
+    compiler = "//packages/typescript/test/angular_plugin:tsc_wrapped_with_angular",
     tsconfig = ":tsconfig.json",
     use_angular_plugin = True,
     deps = [
-        # Needed for the angular compiler plugin
-        "@npm//@angular/compiler-cli",
         "@npm//@angular/core",
     ],
 )
diff --git a/packages/typescript/test/angular_plugin/diagnostic/BUILD.bazel b/packages/typescript/test/angular_plugin/diagnostic/BUILD.bazel
index 796a5d7b5d..bdb1a7e451 100644
--- a/packages/typescript/test/angular_plugin/diagnostic/BUILD.bazel
+++ b/packages/typescript/test/angular_plugin/diagnostic/BUILD.bazel
@@ -20,14 +20,13 @@ ts_library(
     angular_assets = [
         "comp.ng.html",
     ],
+    compiler = "//packages/typescript/test/angular_plugin:tsc_wrapped_with_angular",
     expected_diagnostics = [
         "TS2339: \\[ngtsc\\] Property 'thing' does not exist on type 'Comp'",
     ],
     tsconfig = ":tsconfig.json",
     use_angular_plugin = True,
     deps = [
-        # Needed for the angular compiler plugin
-        "@npm//@angular/compiler-cli",
         "@npm//@angular/core",
     ],
 )
diff --git a/packages/typescript/test/lit_plugin/BUILD.bazel b/packages/typescript/test/lit_plugin/BUILD.bazel
index 572b3d8a9e..a2d4bca4ae 100644
--- a/packages/typescript/test/lit_plugin/BUILD.bazel
+++ b/packages/typescript/test/lit_plugin/BUILD.bazel
@@ -12,11 +12,35 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+load("@build_bazel_rules_nodejs//:index.bzl", "nodejs_binary")
 load("//packages/typescript:index.bzl", "ts_library")
 
+# Custom ts_library compiler that runs tsc_wrapped with ts-lit-plugin statically linked
+# This can be used with worker mode because we don't need the linker at runtime to make
+# the plugin loadable
+# Just a clone of @build_bazel_rules_typescript//internal:tsc_wrapped with added deps
+nodejs_binary(
+    name = "tsc_wrapped_with_lit_plugin",
+    data = [
+        "@build_bazel_rules_typescript//internal:tsc_wrapped",
+        "@build_bazel_rules_typescript//third_party/github.com/bazelbuild/bazel/src/main/protobuf:worker_protocol.proto",
+        "@npm//protobufjs",
+        "@npm//source-map-support",
+        "@npm//ts-lit-plugin",
+        "@npm//tsickle",
+        "@npm//tsutils",
+        "@npm//typescript",
+    ],
+    entry_point = "@build_bazel_rules_typescript//internal:tsc_wrapped/tsc_wrapped.js",
+    # TODO: turn on --worker_sandboxing and remove this flag to see failure to load the plugin
+    templated_args = ["--bazel_patch_module_resolver"],
+    visibility = ["//packages/typescript/test/angular_plugin:__subpackages__"],
+)
+
 ts_library(
     name = "lit_plugin",
     srcs = glob(["*.ts"]),
+    compiler = "tsc_wrapped_with_lit_plugin",
     expected_diagnostics = [
         """TS2322: \\[lit\\] Unknown tag "unknown-element". Did you mean 'lit-element'?""",
         "TS2322: \\[lit\\] Type '222' is not assignable to 'string",
@@ -26,14 +50,8 @@ ts_library(
         "TS2322: \\[lit\\] Type '444' is not assignable to 'string",
         "TS2322: \\[lit\\] Type '{ field: number; }' is not assignable to '{ field: string; }'",
     ],
-    # We need the linker to set up a node_modules tree to discover the plugin
-    # but it isn't compatible with worker mode;
-    # see https://github.com/bazelbuild/rules_nodejs/issues/1803
-    supports_workers = False,
     tsconfig = ":tsconfig.json",
     deps = [
         "@npm//lit-element",
-        # TODO(#850): plugins["@npm//ts-lit-plugin"] instead?
-        "@npm//ts-lit-plugin",
     ],
 )
diff --git a/rules_sass.pr126.patch b/rules_sass.pr126.patch
new file mode 100644
index 0000000000..e6375a8aef
--- /dev/null
+++ b/rules_sass.pr126.patch
@@ -0,0 +1,12 @@
+diff --git a/sass/BUILD b/sass/BUILD
+index 22408d0..230696a 100644
+--- a/sass/BUILD
++++ b/sass/BUILD
+@@ -17,4 +17,7 @@ nodejs_binary(
+         "@build_bazel_rules_sass_deps//sass",
+         "@build_bazel_rules_sass_deps//@bazel/worker",
+     ],
++    # Opt-in to the patched require() function like google3 has
++    # rules_nodejs 3.0 will flip the default for this flag which breaks rules_sass users
++    templated_args = ["--bazel_patch_module_resolver"],
+ )
diff --git a/third_party/github.com/bazelbuild/rules_typescript/internal/BUILD.bazel b/third_party/github.com/bazelbuild/rules_typescript/internal/BUILD.bazel
index d98375e42d..fa4b0d1391 100644
--- a/third_party/github.com/bazelbuild/rules_typescript/internal/BUILD.bazel
+++ b/third_party/github.com/bazelbuild/rules_typescript/internal/BUILD.bazel
@@ -83,6 +83,9 @@ nodejs_binary(
     ],
     entry_point = ":tsc_wrapped/tsc_wrapped.js",
     visibility = ["//visibility:public"],
+    # With RBE or --worker_sandboxing you'll see that when supports_workers=True it doesn't run_node
+    # so it doesn't have the linker. Still needs our custom patches on require()
+    templated_args = ["--bazel_patch_module_resolver"],
 )
 
 ts_library(