diff --git a/WORKSPACE b/WORKSPACE
index 61966dbc..f8fbcfba 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -190,6 +190,10 @@ git_repository(
     commit = "a511f3c90129d7de7ae67c0637001162980c08d5",
     remote = "https://gerrit.googlesource.com/bazlets",
     shallow_since = "1606931369 -0600",
+    patch_args = ["-p1"],
+    patches = [
+        "//third_party:bazlets_py3.patch",
+    ],
 )
 
 load("@com_googlesource_gerrit_bazlets//:gerrit_api.bzl", "gerrit_api")
diff --git a/third_party/bazlets_py3.patch b/third_party/bazlets_py3.patch
new file mode 100644
index 00000000..791eefe5
--- /dev/null
+++ b/third_party/bazlets_py3.patch
@@ -0,0 +1,60 @@
+diff -ur com_googlesource_gerrit_bazlets.orig/tools/js.bzl com_googlesource_gerrit_bazlets/tools/js.bzl
+--- com_googlesource_gerrit_bazlets.orig/tools/js.bzl	2023-09-01 19:06:56.873026919 +0200
++++ com_googlesource_gerrit_bazlets/tools/js.bzl	2023-09-01 19:07:11.222983491 +0200
+@@ -26,7 +26,7 @@
+     else:
+         fail("repository %s not in {%s,%s}" % (repository, GERRIT, NPMJS))
+ 
+-    python = ctx.which("python")
++    python = ctx.which("python3")
+     script = ctx.path(ctx.attr._download_script)
+ 
+     args = [python, script, "-o", dest, "-u", url, "-v", sha1]
+@@ -49,7 +49,7 @@
+ 
+ # for use in repo rules.
+ def _run_npm_binary_str(ctx, tarball, args):
+-    python_bin = ctx.which("python")
++    python_bin = ctx.which("python3")
+     return " ".join([
+         python_bin,
+         ctx.path(ctx.attr._run_npm),
+@@ -63,7 +63,7 @@
+     version_name = "%s__version.json" % ctx.name
+ 
+     cmd = [
+-        ctx.which("python"),
++        ctx.which("python3"),
+         ctx.path(ctx.attr._download_bower),
+         "-b",
+         "%s" % _run_npm_binary_str(ctx, ctx.attr._bower_archive, []),
+@@ -311,7 +311,7 @@
+     zips = [z for d in ctx.attr.deps for z in d[ComponentInfo].transitive_zipfiles.to_list()]
+ 
+     hermetic_npm_binary = " ".join([
+-        "python",
++        "python3",
+         "$p/" + ctx.file._run_npm.path,
+         "$p/" + ctx.file._bundler_archive.path,
+         "--inline-scripts",
+@@ -360,7 +360,7 @@
+ 
+     if ctx.attr.split:
+         hermetic_npm_command = "export PATH && " + " ".join([
+-            "python",
++            "python3",
+             ctx.file._run_npm.path,
+             ctx.file._crisper_archive.path,
+             "--always-write-script",
+diff -ur com_googlesource_gerrit_bazlets.orig/tools/maven_jar.bzl com_googlesource_gerrit_bazlets/tools/maven_jar.bzl
+--- com_googlesource_gerrit_bazlets.orig/tools/maven_jar.bzl	2023-09-01 19:05:59.782193961 +0200
++++ com_googlesource_gerrit_bazlets/tools/maven_jar.bzl	2023-09-01 19:06:23.679125192 +0200
+@@ -136,7 +136,7 @@
+     srcjar_path = ctx.path("/".join(["src", srcjar]))
+     srcurl = url + "-sources.jar"
+ 
+-    python = ctx.which("python")
++    python = ctx.which("python3")
+     script = ctx.path(ctx.attr._download_script)
+ 
+     args = [python, script, "-o", binjar_path, "-u", binurl]