diff --git a/WORKSPACE b/WORKSPACE
index ee3d1591cef3f..aa3b1765b5ba3 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -445,10 +445,15 @@ exports_files(["bundle"])
 filegroup(
     name = "srcs",
     srcs = glob(["**"]),
-    visibility = ["//visibility:public"]
 )
     """,
     integrity = "sha256-Spx8LyM7k+dsGOlZ4TdAq+CNk5EzvYB/oxnY4zGpqPg=",
     strip_prefix = "sourcegraph-extensions-bundles-5.0.1",
     url = "https://github.com/sourcegraph/sourcegraph-extensions-bundles/archive/v5.0.1.zip",
 )
+
+load("//dev:schema_migrations.bzl", "schema_migrations")
+
+schema_migrations(
+    name = "schemas_migrations",
+)
diff --git a/dev/schema_migrations.bzl b/dev/schema_migrations.bzl
new file mode 100644
index 0000000000000..0fee8d31ba2c6
--- /dev/null
+++ b/dev/schema_migrations.bzl
@@ -0,0 +1,42 @@
+def _schema_migrations(rctx):
+    gsutil_path = rctx.path(
+        Label("@gcloud-{}-{}//:gsutil".format({
+            "mac os x": "darwin",
+            "linux": "linux",
+        }[rctx.os.name], {
+            "aarch64": "arm64",
+            "arm64": "arm64",
+            "amd64": "amd64",
+            "x86_64": "amd64",
+            "x86": "amd64",
+        }[rctx.os.arch])),
+    )
+
+    rctx.file("BUILD.bazel", content = """
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["archives"])
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+)
+""")
+
+    rctx.execute(["mkdir", "archives"])
+    rctx.report_progress("Downloading schema migrations from GCS")
+    result = rctx.execute([
+        gsutil_path,
+        "-m",
+        "cp",
+        "gs://schemas-migrations/migrations/*",
+        "archives",
+    ], timeout = 60, environment = {
+        "CLOUDSDK_CORE_PROJECT": "sourcegraph-ci",
+    })
+    if result.return_code != 0:
+        fail("Failed to download schema migrations from GCS: {}".format(result.stderr))
+
+schema_migrations = repository_rule(
+    implementation = _schema_migrations,
+)
diff --git a/dev/tool_deps.bzl b/dev/tool_deps.bzl
index 37ed3f997a40e..3401275761c0e 100644
--- a/dev/tool_deps.bzl
+++ b/dev/tool_deps.bzl
@@ -17,7 +17,11 @@ filegroup(
 """
 
 GCLOUD_VERSION = "456.0.0"
-GCLOUD_BUILDFILE = """package(default_visibility = ["//visibility:public"])\nexports_files(["gcloud", "gsutil", "bq", "git-credential-gcloud"])"""
+GCLOUD_BUILDFILE = """
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["gcloud", "gsutil", "bq", "git-credential-gcloud"])
+"""
 GCLOUD_PATCH_CMDS = [
     "ln -s google-cloud-sdk/bin/gcloud gcloud",
     "ln -s google-cloud-sdk/bin/gsutil gsutil",
diff --git a/internal/database/migration/shared/BUILD.bazel b/internal/database/migration/shared/BUILD.bazel
index 676fafc723517..87e3c77b99ec9 100644
--- a/internal/database/migration/shared/BUILD.bazel
+++ b/internal/database/migration/shared/BUILD.bazel
@@ -24,22 +24,15 @@ genrule(
     srcs = [],
     outs = ["stitched-migration-graph.json"],
     cmd = """\
-        mkdir -p _migration_archives
-        # "-m" flag enables concurrent mode, it's significantly faster even if files are small.
-        CLOUDSDK_CORE_PROJECT="sourcegraph-ci"
-        $(location //dev/tools:gsutil) -m cp "gs://schemas-migrations/migrations/*" _migration_archives/
         $(location //internal/database/migration/shared/data/cmd/generator) \
             -output=$@ \
             -frozen-output=. \
-            -archive=_migration_archives
+            -archive=$(location @schemas_migrations//:archives)
     """,
-    tags = [
-        "no-sandbox",  # gsutil doesn't work sandboxed.
-        "requires-network",  # we're fetching files from a GCP bucket.
-    ],
     tools = [
         "//dev/tools:gsutil",
         "//internal/database/migration/shared/data/cmd/generator",
+        "@schemas_migrations//:archives",
     ],
     visibility = ["//visibility:public"],
 )
diff --git a/internal/database/migration/stitch/archives.go b/internal/database/migration/stitch/archives.go
index 340e0c6f020cf..8791fdbd54f82 100644
--- a/internal/database/migration/stitch/archives.go
+++ b/internal/database/migration/stitch/archives.go
@@ -172,7 +172,7 @@ func (s *LocalMigrationsReader) load(path string) error {
 		}
 		s.m[s.currentVersion] = contents
 	} else {
-		fmt.Printf("WARNING: a tarball for %s already exists, constant is out of date\n.", s.currentVersion)
+		fmt.Printf("WARNING: a tarball for %s already exists, constant is out of date\n", s.currentVersion)
 	}
 
 	return nil