diff --git a/CHANGELOG.md b/CHANGELOG.md
index 469e9d3612..536bc3a669 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -69,6 +69,14 @@ END_UNRELEASED_TEMPLATE
 * (bootstrap) For {obj}`--bootstrap_impl=system_python`, the sys.path order has
   changed from `[app paths, stdlib, runtime site-packages]` to `[stdlib, app
   paths, runtime site-packages]`.
+* If using the (deprecated) autodetecting/runtime_env toolchain, then the Python
+  version specified at build-time *must* match the Python version used at
+  runtime (the {obj}`--@rules_python//python/config_settings:python_version`
+  flag and the {attr}`python_version` attribute control the build-time version
+  for a target). If they don't match, dependencies won't be importable. (Such a
+  misconfiguration was unlikely to work to begin with; this is called out as an
+  FYI).
+* (rules) {obj}`--bootstrap_impl=script` is the default for non-Windows for Bazel 8 and above.
 
 {#v0-0-0-fixed}
 ### Fixed
diff --git a/docs/api/rules_python/python/config_settings/index.md b/docs/api/rules_python/python/config_settings/index.md
index 989ebf1128..b2d01f0607 100644
--- a/docs/api/rules_python/python/config_settings/index.md
+++ b/docs/api/rules_python/python/config_settings/index.md
@@ -245,8 +245,14 @@ Values:
 ::::{bzl:flag} bootstrap_impl
 Determine how programs implement their startup process.
 
+The default for this depends on the platform and environment:
+* Windows: `system_python` (**always** used)
+* Non-Windows with Bazel 8 or higher: `script`
+* Other: `system_python`
+
+
 Values:
-* `system_python`: (default) Use a bootstrap that requires a system Python available
+* `system_python`: Use a bootstrap that requires a system Python available
   in order to start programs. This requires
   {obj}`PyRuntimeInfo.bootstrap_template` to be a Python program.
 * `script`: Use a bootstrap that uses an arbitrary executable script (usually a
@@ -269,6 +275,10 @@ instead.
 :::{versionadded} 0.33.0
 :::
 
+:::{versionchanged} VERSION_NEXT_FEATURE
+* The default changed from `system_python` to `script` for non-Windows with Bazel 8 or higher.
+:::
+
 ::::
 
 ::::{bzl:flag} current_config
diff --git a/python/config_settings/BUILD.bazel b/python/config_settings/BUILD.bazel
index cc5c472fe7..42c64c5311 100644
--- a/python/config_settings/BUILD.bazel
+++ b/python/config_settings/BUILD.bazel
@@ -1,5 +1,6 @@
 load("@bazel_skylib//rules:common_settings.bzl", "bool_flag", "string_flag")
 load("@pythons_hub//:versions.bzl", "DEFAULT_PYTHON_VERSION", "MINOR_MAPPING", "PYTHON_VERSIONS")
+load("@rules_python_internal//:rules_python_config.bzl", rp_config = "config")
 load(
     "//python/private:flags.bzl",
     "AddSrcsToRunfilesFlag",
@@ -90,7 +91,7 @@ string_flag(
 
 rp_string_flag(
     name = "bootstrap_impl",
-    build_setting_default = BootstrapImplFlag.SYSTEM_PYTHON,
+    build_setting_default = rp_config.bootstrap_impl_default,
     override = select({
         # Windows doesn't yet support bootstrap=script, so force disable it
         ":_is_windows": BootstrapImplFlag.SYSTEM_PYTHON,
diff --git a/python/private/internal_config_repo.bzl b/python/private/internal_config_repo.bzl
index 109e68a8a1..d6fcd88734 100644
--- a/python/private/internal_config_repo.bzl
+++ b/python/private/internal_config_repo.bzl
@@ -30,6 +30,7 @@ _CONFIG_TEMPLATE = """
 config = struct(
   enable_pystar = True,
   enable_pipstar = {enable_pipstar},
+  bootstrap_impl_default = "{bootstrap_impl_default}",
   enable_deprecation_warnings = {enable_deprecation_warnings},
   BuiltinPyInfo = getattr(getattr(native, "legacy_globals", None), "PyInfo", {builtin_py_info_symbol}),
   BuiltinPyRuntimeInfo = getattr(getattr(native, "legacy_globals", None), "PyRuntimeInfo", {builtin_py_runtime_info_symbol}),
@@ -86,32 +87,38 @@ _TRANSITION_SETTINGS_DEBUG_TEMPLATE = """
 """
 
 def _internal_config_repo_impl(rctx):
+    # TODO: remove the conditional once bazel 7 is no longer supported
     if not native.bazel_version or int(native.bazel_version.split(".")[0]) >= 8:
         builtin_py_info_symbol = "None"
         builtin_py_runtime_info_symbol = "None"
         builtin_py_cc_link_params_provider = "None"
+
+        # NOTE @aignas 2025-09-28: we are not using flag constants due to circular
+        # declarations in the WORKSPACE case
+        bootstrap_impl_default = "script"
     else:
         builtin_py_info_symbol = "PyInfo"
         builtin_py_runtime_info_symbol = "PyRuntimeInfo"
         builtin_py_cc_link_params_provider = "PyCcLinkParamsProvider"
 
+        # NOTE @aignas 2025-09-28: we are not using flag constants due to circular
+        # declarations in the WORKSPACE case
+        bootstrap_impl_default = "system_python"
+
     rctx.file("rules_python_config.bzl", _CONFIG_TEMPLATE.format(
         enable_pipstar = _bool_from_environ(rctx, _ENABLE_PIPSTAR_ENVVAR_NAME, _ENABLE_PIPSTAR_DEFAULT),
+        bootstrap_impl_default = bootstrap_impl_default,
         enable_deprecation_warnings = _bool_from_environ(rctx, _ENABLE_DEPRECATION_WARNINGS_ENVVAR_NAME, _ENABLE_DEPRECATION_WARNINGS_DEFAULT),
         builtin_py_info_symbol = builtin_py_info_symbol,
         builtin_py_runtime_info_symbol = builtin_py_runtime_info_symbol,
         builtin_py_cc_link_params_provider = builtin_py_cc_link_params_provider,
     ))
 
-    shim_content = _PY_INTERNAL_SHIM
-    py_internal_dep = '"@rules_python//tools/build_defs/python/private:py_internal_renamed_bzl"'
-
     rctx.file("BUILD", ROOT_BUILD_TEMPLATE.format(
-        py_internal_dep = py_internal_dep,
+        py_internal_dep = '"@rules_python//tools/build_defs/python/private:py_internal_renamed_bzl"',
         visibility = "@rules_python//:__subpackages__",
     ))
-    rctx.file("py_internal.bzl", shim_content)
-
+    rctx.file("py_internal.bzl", _PY_INTERNAL_SHIM)
     rctx.file(
         "extra_transition_settings.bzl",
         _EXTRA_TRANSITIONS_TEMPLATE.format(