diff --git a/build/teamcity/cockroach/ci/builds/build_impl.sh b/build/teamcity/cockroach/ci/builds/build_impl.sh
index d98b0242ce3b..11b795b81c39 100755
--- a/build/teamcity/cockroach/ci/builds/build_impl.sh
+++ b/build/teamcity/cockroach/ci/builds/build_impl.sh
@@ -10,17 +10,18 @@ fi
 
 CONFIG="$1"
 
-# Only build generated files on Linux x86_64.
-GENFILES_TARGETS=
+# Extra targets to build on Linux x86_64 only.
+EXTRA_TARGETS=
 if [ "$CONFIG" == "crosslinux" ]
 then
     DOC_TARGETS=$(grep '^//' docs/generated/bazel_targets.txt)
     GO_TARGETS=$(grep -v '^#' build/bazelutil/checked_in_genfiles.txt | cut -d'|' -f1)
-    GENFILES_TARGETS="$DOC_TARGETS $GO_TARGETS"
+    BINARY_TARGETS=@com_github_cockroachdb_go_test_teamcity//:go-test-teamcity
+    EXTRA_TARGETS="$DOC_TARGETS $GO_TARGETS $BINARY_TARGETS"
 fi
 
 bazel build //pkg/cmd/bazci --config=ci
 $(bazel info bazel-bin --config=ci)/pkg/cmd/bazci/bazci_/bazci --compilation_mode opt \
 		       --config "$CONFIG" --config ci --config with_ui \
 		       build //pkg/cmd/cockroach-short //pkg/cmd/cockroach \
-		       //pkg/cmd/cockroach-oss //c-deps:libgeos $GENFILES_TARGETS
+		       //pkg/cmd/cockroach-oss //c-deps:libgeos $EXTRA_TARGETS
diff --git a/go.mod b/go.mod
index 9f1491b96f78..861085e7c556 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,6 @@ require (
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.8
 	github.com/Azure/go-autorest/autorest/to v0.4.0
 	github.com/BurntSushi/toml v0.4.1
-	github.com/DataDog/zstd v1.4.8 // indirect
 	github.com/MichaelTJones/walk v0.0.0-20161122175330-4748e29d5718
 	github.com/PuerkitoBio/goquery v1.5.1
 	github.com/Shopify/sarama v1.29.0
@@ -20,7 +19,6 @@ require (
 	github.com/abourget/teamcity v0.0.0-00010101000000-000000000000
 	github.com/alessio/shellescape v1.4.1
 	github.com/andy-kimball/arenaskl v0.0.0-20200617143215-f701008588b9
-	github.com/andybalholm/cascadia v1.2.0 // indirect
 	github.com/apache/arrow/go/arrow v0.0.0-20200923215132-ac86123a3f01
 	github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e
 	github.com/aws/aws-sdk-go v1.40.37
@@ -55,7 +53,6 @@ require (
 	github.com/containerd/containerd v1.5.4
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/dave/dst v0.24.0
-	github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc // indirect
 	github.com/docker/distribution v2.7.1+incompatible
 	github.com/docker/docker v20.10.8+incompatible
 	github.com/docker/go-connections v0.4.0
@@ -66,17 +63,11 @@ require (
 	github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a
 	github.com/fraugster/parquet-go v0.4.0
 	github.com/ghemawat/stream v0.0.0-20171120220530-696b145b53b9
-	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-sql-driver/mysql v1.6.0
 	github.com/go-swagger/go-swagger v0.26.1
 	github.com/gogo/protobuf v1.3.2
-	github.com/golang-commonmark/html v0.0.0-20180910111043-7d7c804e1d46 // indirect
-	github.com/golang-commonmark/linkify v0.0.0-20180910111149-f05efb453a0e // indirect
 	github.com/golang-commonmark/markdown v0.0.0-20180910011815-a8f139058164
-	github.com/golang-commonmark/mdurl v0.0.0-20180910110917-8d018c6567d6 // indirect
-	github.com/golang-commonmark/puny v0.0.0-20180910110745-050be392d8b8 // indirect
 	github.com/golang/geo v0.0.0-20200319012246-673a6f80352d
-	github.com/golang/glog v0.0.0-20210429001901-424d2337a529 // indirect
 	github.com/golang/mock v1.6.0
 	github.com/golang/protobuf v1.5.2
 	github.com/golang/snappy v0.0.4
@@ -112,7 +103,6 @@ require (
 	github.com/maruel/panicparse/v2 v2.2.0
 	github.com/marusama/semaphore v0.0.0-20190110074507-6952cef993b2
 	github.com/mattn/go-isatty v0.0.14
-	github.com/mattn/go-zglob v0.0.3 // indirect
 	github.com/mattn/goveralls v0.0.2
 	github.com/mibk/dupl v1.0.0
 	github.com/mitchellh/reflectwalk v1.0.0
@@ -120,12 +110,9 @@ require (
 	github.com/montanaflynn/stats v0.6.3
 	github.com/olekukonko/tablewriter v0.0.5-0.20200416053754-163badb3bac6
 	github.com/opencontainers/image-spec v1.0.1
-	github.com/opennota/wd v0.0.0-20180911144301-b446539ab1e7 // indirect
-	github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea // indirect
 	github.com/petermattis/goid v0.0.0-20211229010228-4d14c490ee36
 	github.com/pierrre/geohash v1.0.0
 	github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0
 	github.com/prometheus/client_golang v1.11.0
 	github.com/prometheus/client_model v0.2.1-0.20210607210712-147c58e9608a
@@ -133,24 +120,20 @@ require (
 	github.com/prometheus/prometheus v1.8.2-0.20210914090109-37468d88dce8
 	github.com/pseudomuto/protoc-gen-doc v1.3.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
-	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.1
 	github.com/shirou/gopsutil/v3 v3.21.12
 	github.com/slack-go/slack v0.9.5
 	github.com/spf13/cobra v1.1.3
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.7.0
-	github.com/tklauser/go-sysconf v0.3.9 // indirect
 	github.com/twpayne/go-geom v1.4.1
 	github.com/wadey/gocovmerge v0.0.0-20160331181800-b5bfa59ec0ad
-	github.com/xdg/scram v1.0.3
+	github.com/xdg-go/scram v1.0.2
+	github.com/xdg-go/stringprep v1.0.2
 	github.com/zabawaba99/go-gitignore v0.0.0-20200117185801-39e6bddfb292
 	go.etcd.io/etcd/raft/v3 v3.0.0-20210320072418-e51c697ec6e8
 	go.opentelemetry.io/otel v1.0.0-RC3
 	go.opentelemetry.io/otel/exporters/jaeger v1.0.0-RC3
-	// The indicated commit is required on top of v1.0.0-RC3 because
-	// it fixes an import comment that otherwise breaks our prereqs tool.
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.0.0-RC3.0.20210907151655-df2bdbbadb26 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.0.0-RC3
 	go.opentelemetry.io/otel/exporters/zipkin v1.0.0-RC3
 	go.opentelemetry.io/otel/sdk v1.0.0-RC3
@@ -158,7 +141,6 @@ require (
 	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5
 	golang.org/x/exp v0.0.0-20210514180818-737f94c0881e
 	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616
-	golang.org/x/mod v0.5.1 // indirect
 	golang.org/x/net v0.0.0-20210913180222-943fd674d43e
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8
 	golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852
@@ -171,7 +153,6 @@ require (
 	google.golang.org/api v0.63.0
 	google.golang.org/genproto v0.0.0-20211222154725-9823f7ba7562
 	google.golang.org/grpc v1.43.0
-	google.golang.org/grpc/examples v0.0.0-20210324172016-702608ffae4d // indirect
 	google.golang.org/protobuf v1.27.1
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
@@ -191,6 +172,7 @@ require (
 	github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/DataDog/zstd v1.4.8 // indirect
 	github.com/Masterminds/goutils v1.1.0 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
@@ -198,6 +180,7 @@ require (
 	github.com/PuerkitoBio/purell v1.1.1 // indirect
 	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/alexbrainman/sspi v0.0.0-20180613141037-e580b900e9f5 // indirect
+	github.com/andybalholm/cascadia v1.2.0 // indirect
 	github.com/apache/thrift v0.13.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.4.2 // indirect
@@ -216,6 +199,7 @@ require (
 	github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/eapache/go-resiliency v1.2.0 // indirect
@@ -228,6 +212,7 @@ require (
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-kit/log v0.1.0 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/analysis v0.20.0 // indirect
 	github.com/go-openapi/errors v0.20.0 // indirect
 	github.com/go-openapi/inflect v0.19.0 // indirect
@@ -244,7 +229,12 @@ require (
 	github.com/gofrs/uuid v4.0.0+incompatible // indirect
 	github.com/gogo/googleapis v1.4.1 // indirect
 	github.com/gogo/status v1.1.0 // indirect
+	github.com/golang-commonmark/html v0.0.0-20180910111043-7d7c804e1d46 // indirect
+	github.com/golang-commonmark/linkify v0.0.0-20180910111149-f05efb453a0e // indirect
+	github.com/golang-commonmark/mdurl v0.0.0-20180910110917-8d018c6567d6 // indirect
+	github.com/golang-commonmark/puny v0.0.0-20180910110745-050be392d8b8 // indirect
 	github.com/golang-jwt/jwt/v4 v4.0.0 // indirect
+	github.com/golang/glog v0.0.0-20210429001901-424d2337a529 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/go-querystring v1.0.0 // indirect
 	github.com/google/uuid v1.3.0 // indirect
@@ -280,6 +270,7 @@ require (
 	github.com/mailru/easyjson v0.7.6 // indirect
 	github.com/mattn/go-ieproxy v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.7 // indirect
+	github.com/mattn/go-zglob v0.0.3 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/mitchellh/copystructure v1.0.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -291,14 +282,18 @@ require (
 	github.com/mwitkow/go-proto-validators v0.0.0-20180403085117-0950a7990007 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opennota/wd v0.0.0-20180911144301-b446539ab1e7 // indirect
 	github.com/openzipkin/zipkin-go v0.2.5 // indirect
 	github.com/pelletier/go-toml v1.8.1 // indirect
+	github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea // indirect
 	github.com/pierrec/lz4 v2.6.0+incompatible // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.6.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/pquerna/cachecontrol v0.0.0-20200921180117-858c6e7e6b7e // indirect
 	github.com/prometheus/procfs v0.6.0 // indirect
 	github.com/pseudomuto/protokit v0.2.0 // indirect
+	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.0.1 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/sirupsen/logrus v1.8.1 // indirect
@@ -307,20 +302,26 @@ require (
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/viper v1.7.1 // indirect
 	github.com/subosito/gotenv v1.2.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.9 // indirect
 	github.com/tklauser/numcpus v0.3.0 // indirect
 	github.com/toqueteos/webbrowser v1.2.0 // indirect
 	github.com/twitchtv/twirp v7.1.1+incompatible // indirect
 	github.com/twpayne/go-kml v1.5.2 // indirect
-	github.com/xdg/stringprep v1.0.3 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
 	go.mongodb.org/mongo-driver v1.5.1 // indirect
 	go.opencensus.io v0.23.0 // indirect
+	// The indicated commit is required on top of v1.0.0-RC3 because
+	// it fixes an import comment that otherwise breaks our prereqs tool.
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.0.0-RC3.0.20210907151655-df2bdbbadb26 // indirect
 	go.opentelemetry.io/proto/otlp v0.9.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.7.0 // indirect
 	go.uber.org/zap v1.19.0 // indirect
+	golang.org/x/mod v0.5.1 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/grpc/examples v0.0.0-20210324172016-702608ffae4d // indirect
 	gopkg.in/ini.v1 v1.62.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
 )
diff --git a/go.sum b/go.sum
index ed520fc3907f..c1b023117284 100644
--- a/go.sum
+++ b/go.sum
@@ -1975,15 +1975,16 @@ github.com/willf/bitset v1.1.3/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPyS
 github.com/willf/bitset v1.1.9/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.0.2 h1:akYIkZ28e6A96dkWNJQu3nmCzH3YfwMPQExUYDaRv7w=
 github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
+github.com/xdg-go/stringprep v1.0.2 h1:6iq84/ryjjeRmMJwxutI51F2GIPlP5BfTvXHeYjyhBc=
 github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
 github.com/xdg/scram v0.0.0-20180814205039-7eeb5667e42c/go.mod h1:lB8K/P019DLNhemzwFU4jHLhdvlE6uDZjXFejJXr49I=
-github.com/xdg/scram v1.0.3 h1:nTadYh2Fs4BK2xdldEa2g5bbaZp0/+1nJMMPtPxS/to=
 github.com/xdg/scram v1.0.3/go.mod h1:lB8K/P019DLNhemzwFU4jHLhdvlE6uDZjXFejJXr49I=
 github.com/xdg/stringprep v0.0.0-20180714160509-73f8eece6fdc/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0HrGL1Y=
 github.com/xdg/stringprep v1.0.0/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0HrGL1Y=
-github.com/xdg/stringprep v1.0.3 h1:cmL5Enob4W83ti/ZHuZLuKD/xqJfus4fVPwE+/BDm+4=
 github.com/xdg/stringprep v1.0.3/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0HrGL1Y=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
diff --git a/pkg/build/util/util.go b/pkg/build/util/util.go
index e9e4b3949126..e323783e498b 100644
--- a/pkg/build/util/util.go
+++ b/pkg/build/util/util.go
@@ -21,9 +21,9 @@ import (
 
 // OutputOfBinaryRule returns the path of the binary produced by the
 // given build target, relative to bazel-bin. That is,
-//    filepath.Join(bazelBin, OutputOfBinaryRule(target)) is the absolute
+//    filepath.Join(bazelBin, OutputOfBinaryRule(target, isWindows)) is the absolute
 // path to the build binary for the target.
-func OutputOfBinaryRule(target string) string {
+func OutputOfBinaryRule(target string, isWindows bool) string {
 	colon := strings.Index(target, ":")
 	var bin string
 	if colon >= 0 {
@@ -42,6 +42,9 @@ func OutputOfBinaryRule(target string) string {
 	} else {
 		head = strings.TrimPrefix(target, "//")
 	}
+	if isWindows {
+		return filepath.Join(head, bin+"_", bin+".exe")
+	}
 	return filepath.Join(head, bin+"_", bin)
 }
 
diff --git a/pkg/build/util/util_test.go b/pkg/build/util/util_test.go
index cb781a4683c8..9afd649d0653 100644
--- a/pkg/build/util/util_test.go
+++ b/pkg/build/util/util_test.go
@@ -17,17 +17,26 @@ import (
 )
 
 func TestOutputOfBinaryRule(t *testing.T) {
-	require.Equal(t, OutputOfBinaryRule("//pkg/cmd/cockroach-short"),
+	require.Equal(t, OutputOfBinaryRule("//pkg/cmd/cockroach-short", false),
 		"pkg/cmd/cockroach-short/cockroach-short_/cockroach-short")
-	require.Equal(t, OutputOfBinaryRule("//pkg/cmd/cockroach-short:cockroach-short"),
+	require.Equal(t, OutputOfBinaryRule("//pkg/cmd/cockroach-short", true),
+		"pkg/cmd/cockroach-short/cockroach-short_/cockroach-short.exe")
+	require.Equal(t, OutputOfBinaryRule("//pkg/cmd/cockroach-short:cockroach-short", false),
 		"pkg/cmd/cockroach-short/cockroach-short_/cockroach-short")
-	require.Equal(t, OutputOfBinaryRule("pkg/cmd/cockroach-short"),
+	require.Equal(t, OutputOfBinaryRule("//pkg/cmd/cockroach-short:cockroach-short", true),
+		"pkg/cmd/cockroach-short/cockroach-short_/cockroach-short.exe")
+	require.Equal(t, OutputOfBinaryRule("pkg/cmd/cockroach-short", false),
 		"pkg/cmd/cockroach-short/cockroach-short_/cockroach-short")
-
-	require.Equal(t, OutputOfBinaryRule("@com_github_cockroachdb_stress//:stress"),
+	require.Equal(t, OutputOfBinaryRule("pkg/cmd/cockroach-short", true),
+		"pkg/cmd/cockroach-short/cockroach-short_/cockroach-short.exe")
+	require.Equal(t, OutputOfBinaryRule("@com_github_cockroachdb_stress//:stress", false),
 		"external/com_github_cockroachdb_stress/stress_/stress")
-	require.Equal(t, OutputOfBinaryRule("@com_github_bazelbuild_buildtools//buildifier:buildifier"),
+	require.Equal(t, OutputOfBinaryRule("@com_github_cockroachdb_stress//:stress", true),
+		"external/com_github_cockroachdb_stress/stress_/stress.exe")
+	require.Equal(t, OutputOfBinaryRule("@com_github_bazelbuild_buildtools//buildifier:buildifier", false),
 		"external/com_github_bazelbuild_buildtools/buildifier/buildifier_/buildifier")
+	require.Equal(t, OutputOfBinaryRule("@com_github_bazelbuild_buildtools//buildifier:buildifier", true),
+		"external/com_github_bazelbuild_buildtools/buildifier/buildifier_/buildifier.exe")
 }
 
 func TestOutputsOfGenrule(t *testing.T) {
diff --git a/pkg/ccl/changefeedccl/BUILD.bazel b/pkg/ccl/changefeedccl/BUILD.bazel
index a71a39681fb9..dd5d3ae98e84 100644
--- a/pkg/ccl/changefeedccl/BUILD.bazel
+++ b/pkg/ccl/changefeedccl/BUILD.bazel
@@ -111,7 +111,7 @@ go_library(
         "@com_github_google_btree//:btree",
         "@com_github_linkedin_goavro_v2//:goavro",
         "@com_github_shopify_sarama//:sarama",
-        "@com_github_xdg_scram//:scram",
+        "@com_github_xdg_go_scram//:scram",
         "@com_google_cloud_go_pubsub//:pubsub",
         "@org_golang_google_api//option",
         "@org_golang_google_grpc//codes",
diff --git a/pkg/ccl/changefeedccl/scram_client.go b/pkg/ccl/changefeedccl/scram_client.go
index 6d2f5b7e044e..5432a1f89819 100644
--- a/pkg/ccl/changefeedccl/scram_client.go
+++ b/pkg/ccl/changefeedccl/scram_client.go
@@ -13,7 +13,7 @@ import (
 	"crypto/sha512"
 
 	"github.com/Shopify/sarama"
-	"github.com/xdg/scram"
+	"github.com/xdg-go/scram"
 )
 
 var (
diff --git a/pkg/cmd/bazci/watch.go b/pkg/cmd/bazci/watch.go
index a11736f6402c..a16d56a72fd9 100644
--- a/pkg/cmd/bazci/watch.go
+++ b/pkg/cmd/bazci/watch.go
@@ -195,15 +195,7 @@ type xmlMessage struct {
 // results.)
 func (w watcher) stageBinaryArtifacts() error {
 	for _, bin := range w.info.goBinaries {
-		// Convert a target like `//pkg/cmd/cockroach-short` to the
-		// relative path atop bazel-bin where that file can be found --
-		// in this example, `pkg/cmd/cockroach-short/cockroach-short_/cockroach-short.
-		head := strings.ReplaceAll(strings.TrimPrefix(bin, "//"), ":", "/")
-		components := strings.Split(bin, ":")
-		relBinPath := path.Join(head+"_", components[len(components)-1])
-		if usingCrossWindowsConfig() {
-			relBinPath = relBinPath + ".exe"
-		}
+		relBinPath := bazelutil.OutputOfBinaryRule(bin, usingCrossWindowsConfig())
 		err := w.maybeStageArtifact(binSourceDir, relBinPath, 0755, finalizePhase,
 			copyContentTo)
 		if err != nil {
diff --git a/pkg/cmd/dev/build.go b/pkg/cmd/dev/build.go
index 638542de3029..3d13a26fed34 100644
--- a/pkg/cmd/dev/build.go
+++ b/pkg/cmd/dev/build.go
@@ -17,6 +17,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"runtime"
 	"strings"
 
 	"github.com/alessio/shellescape"
@@ -133,7 +134,8 @@ func (d *dev) build(cmd *cobra.Command, commandLine []string) error {
 	script.WriteString(fmt.Sprintf("bazel %s\n", strings.Join(args, " ")))
 	script.WriteString(fmt.Sprintf("BAZELBIN=`bazel info bazel-bin --color=no --config=%s --config=ci`\n", cross))
 	for _, target := range buildTargets {
-		script.WriteString(fmt.Sprintf("cp $BAZELBIN/%s /artifacts\n", bazelutil.OutputOfBinaryRule(target.fullName)))
+		script.WriteString(fmt.Sprintf("cp $BAZELBIN/%s /artifacts\n",
+			bazelutil.OutputOfBinaryRule(target.fullName, strings.Contains(cross, "windows"))))
 	}
 	_, err = d.exec.CommandContextWithInput(ctx, script.String(), "docker", dockerArgs...)
 	if err != nil {
@@ -164,7 +166,7 @@ func (d *dev) stageArtifacts(ctx context.Context, targets []buildTarget, skipGen
 			// Skip staging for these.
 			continue
 		}
-		binaryPath := filepath.Join(bazelBin, bazelutil.OutputOfBinaryRule(target.fullName))
+		binaryPath := filepath.Join(bazelBin, bazelutil.OutputOfBinaryRule(target.fullName, runtime.GOOS == "windows"))
 		base := targetToBinBasename(target.fullName)
 		var symlinkPath string
 		// Binaries beginning with the string "cockroach" go right at
diff --git a/pkg/security/BUILD.bazel b/pkg/security/BUILD.bazel
index c0cb4b687230..2a98946d7ff1 100644
--- a/pkg/security/BUILD.bazel
+++ b/pkg/security/BUILD.bazel
@@ -42,6 +42,7 @@ go_library(
         "@com_github_cockroachdb_errors//:errors",
         "@com_github_cockroachdb_errors//oserror",
         "@com_github_cockroachdb_redact//:redact",
+        "@com_github_xdg_go_stringprep//:stringprep",
         "@org_golang_x_crypto//bcrypt",
         "@org_golang_x_crypto//ocsp",
         "@org_golang_x_sync//errgroup",
diff --git a/pkg/security/password.go b/pkg/security/password.go
index 2b9575a8f6a9..bfaca3ea469c 100644
--- a/pkg/security/password.go
+++ b/pkg/security/password.go
@@ -23,6 +23,8 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/util/log"
 	"github.com/cockroachdb/cockroach/pkg/util/quotapool"
 	"github.com/cockroachdb/errors"
+	// Reserved import for PR #74301.
+	_ "github.com/xdg-go/stringprep"
 	"golang.org/x/crypto/bcrypt"
 )
 
diff --git a/pkg/sql/pgwire/server.go b/pkg/sql/pgwire/server.go
index 991e6ac61bce..d9754d836e10 100644
--- a/pkg/sql/pgwire/server.go
+++ b/pkg/sql/pgwire/server.go
@@ -1042,8 +1042,12 @@ func (s *Server) maybeUpgradeToSecureConn(
 	}
 
 	if connType == hba.ConnLocal {
+		// No existing PostgreSQL driver ever tries to activate TLS over
+		// a unix socket. But in case someone, sometime, somewhere, makes
+		// that mistake, let them know that we don't want it.
 		clientErr = pgerror.New(pgcode.ProtocolViolation,
 			"cannot use SSL/TLS over local connections")
+		return
 	}
 
 	// Protocol sanity check.
diff --git a/pkg/sql/physicalplan/replicaoracle/BUILD.bazel b/pkg/sql/physicalplan/replicaoracle/BUILD.bazel
index 5a809a787762..4a38b3cc9a31 100644
--- a/pkg/sql/physicalplan/replicaoracle/BUILD.bazel
+++ b/pkg/sql/physicalplan/replicaoracle/BUILD.bazel
@@ -12,6 +12,7 @@ go_library(
         "//pkg/rpc",
         "//pkg/settings/cluster",
         "//pkg/sql/sqlerrors",
+        "//pkg/util",
         "@com_github_cockroachdb_errors//:errors",
     ],
 )
diff --git a/pkg/sql/physicalplan/replicaoracle/oracle.go b/pkg/sql/physicalplan/replicaoracle/oracle.go
index 38eddb98d07e..67d375cda6f6 100644
--- a/pkg/sql/physicalplan/replicaoracle/oracle.go
+++ b/pkg/sql/physicalplan/replicaoracle/oracle.go
@@ -23,6 +23,7 @@ import (
 	"github.com/cockroachdb/cockroach/pkg/rpc"
 	"github.com/cockroachdb/cockroach/pkg/settings/cluster"
 	"github.com/cockroachdb/cockroach/pkg/sql/sqlerrors"
+	"github.com/cockroachdb/cockroach/pkg/util"
 	"github.com/cockroachdb/errors"
 )
 
@@ -106,14 +107,13 @@ var oracleFactories = map[Policy]OracleFactory{}
 // QueryState encapsulates the history of assignments of ranges to nodes
 // done by an oracle on behalf of one particular query.
 type QueryState struct {
-	RangesPerNode  map[roachpb.NodeID]int
+	RangesPerNode  util.FastIntMap
 	AssignedRanges map[roachpb.RangeID]roachpb.ReplicaDescriptor
 }
 
 // MakeQueryState creates an initialized QueryState.
 func MakeQueryState() QueryState {
 	return QueryState{
-		RangesPerNode:  make(map[roachpb.NodeID]int),
 		AssignedRanges: make(map[roachpb.RangeID]roachpb.ReplicaDescriptor),
 	}
 }
@@ -233,7 +233,7 @@ func (o *binPackingOracle) ChoosePreferredReplica(
 	minLoad := int(math.MaxInt32)
 	var leastLoadedIdx int
 	for i, repl := range replicas {
-		assignedRanges := queryState.RangesPerNode[repl.NodeID]
+		assignedRanges := queryState.RangesPerNode.GetDefault(int(repl.NodeID))
 		if assignedRanges != 0 && assignedRanges < o.maxPreferredRangesPerLeaseHolder {
 			return repl.ReplicaDescriptor, nil
 		}
diff --git a/pkg/sql/physicalplan/span_resolver.go b/pkg/sql/physicalplan/span_resolver.go
index a1c00697d551..f3b5a9d38921 100644
--- a/pkg/sql/physicalplan/span_resolver.go
+++ b/pkg/sql/physicalplan/span_resolver.go
@@ -267,7 +267,8 @@ func (it *spanResolverIterator) ReplicaInfo(
 	if err != nil {
 		return roachpb.ReplicaDescriptor{}, err
 	}
-	it.queryState.RangesPerNode[repl.NodeID]++
+	prev := it.queryState.RangesPerNode.GetDefault(int(repl.NodeID))
+	it.queryState.RangesPerNode.Set(int(repl.NodeID), prev+1)
 	it.queryState.AssignedRanges[rngID] = repl
 	return repl, nil
 }
diff --git a/vendor b/vendor
index 633af311f94e..9b521d0ba7c0 160000
--- a/vendor
+++ b/vendor
@@ -1 +1 @@
-Subproject commit 633af311f94ee8fbcbc95346f82cfc14f37f337a
+Subproject commit 9b521d0ba7c017758a98ce9340befd0ec6092e76