diff --git a/WORKSPACE b/WORKSPACE
index bb535aa..66dc544 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -23,9 +23,9 @@
 
 http_archive(
     name = "rules_python",
+    sha256 = "b590e4fc07ec842b8cc8a39a4ca0336f44d7d5f96753229d240884cd016dc1e3",
     strip_prefix = "rules_python-{}".format(rules_python_version),
     url = "https://github.com/bazelbuild/rules_python/archive/{}.zip".format(rules_python_version),
-    sha256 = "b590e4fc07ec842b8cc8a39a4ca0336f44d7d5f96753229d240884cd016dc1e3",
 )
 
 # Download Go/Gazelle rules
@@ -89,6 +89,13 @@
 # gazelle:repository_macro third_party/go/repositories.bzl%go_repositories
 load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
 
+go_repository(
+    name = "com_github_google_shlex",
+    importpath = "github.com/google/shlex",
+    sum = "h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=",
+    version = "v0.0.0-20191202100458-e7afc7fbc510",
+)
+
 gazelle_dependencies()
 
 # Load Go third-party packages.
@@ -127,18 +134,18 @@
 
 container_pull(
     name = "prodimage-bionic",
+    digest = "sha256:1cd1f84169b8e1414a5d511b42909f2d540831c67b6799ae9af8cd6a80d75b5f",
     registry = "registry.k0.hswaw.net",
     repository = "q3k/prodimage",
     tag = "20190822-1227",
-    digest = "sha256:1cd1f84169b8e1414a5d511b42909f2d540831c67b6799ae9af8cd6a80d75b5f",
 )
 
 container_pull(
     name = "gerrit-3.3.2",
+    digest = "sha256:f7fc8b749706f38475f94191117091973914a8f084e69518deff7dbc9c2c557d",
     registry = "index.docker.io",
     repository = "gerritcodereview/gerrit",
     tag = "3.3.2-ubuntu20",
-    digest = "sha256:f7fc8b749706f38475f94191117091973914a8f084e69518deff7dbc9c2c557d",
 )
 
 # third_party/factorio
@@ -150,8 +157,8 @@
 
 git_repository(
     name = "com_googlesource_gerrit_bazlets",
-    remote = "https://gerrit.googlesource.com/bazlets",
     commit = "a511f3c90129d7de7ae67c0637001162980c08d5",
+    remote = "https://gerrit.googlesource.com/bazlets",
     shallow_since = "1606931369 -0600",
 )
 
@@ -176,11 +183,11 @@
 #
 http_file(
     name = "org_q3k_gerrit_3_3_2_backport",
+    downloaded_file_path = "gerrit.war",
+    sha256 = "d1839d691a8534f4ccb27bed9a98281e45972fbebec50d004cecd4d5da2b15a6",
     urls = [
         "https://object.ceph-waw3.hswaw.net/q3k-personal/d1839d691a8534f4ccb27bed9a98281e45972fbebec50d004cecd4d5da2b15a6.war",
     ],
-    downloaded_file_path = "gerrit.war",
-    sha256 = "d1839d691a8534f4ccb27bed9a98281e45972fbebec50d004cecd4d5da2b15a6",
 )
 
 # minecraft spigot/bukkit deps
@@ -199,8 +206,8 @@
 
 http_archive(
     name = "rules_jvm_external",
-    strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
     sha256 = RULES_JVM_EXTERNAL_SHA,
+    strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
     url = "https://github.com/bazelbuild/rules_jvm_external/archive/%s.zip" % RULES_JVM_EXTERNAL_TAG,
 )
 
@@ -215,13 +222,13 @@
         "io.grpc:grpc-services:1.29.0",
     ] + IO_GRPC_GRPC_JAVA_ARTIFACTS,
     generate_compat_repositories = True,
+    maven_install_json = "//third_party/java:maven_install.json",
     override_targets = IO_GRPC_GRPC_JAVA_OVERRIDE_TARGETS,
     repositories = [
         "https://hub.spigotmc.org/nexus/content/repositories/snapshots",
         "https://oss.sonatype.org/content/repositories/snapshots",
         "https://repo1.maven.org/maven2/",
     ],
-    maven_install_json = "//third_party/java:maven_install.json",
 )
 
 load("@maven//:defs.bzl", "pinned_maven_install")
@@ -240,8 +247,8 @@
 
 git_repository(
     name = "com_googlesource_gerrit_plugin_owners",
-    remote = "https://gerrit.googlesource.com/plugins/owners/",
     commit = "17817c9e319073c03513f9d5177b6142b8fd567b",
+    remote = "https://gerrit.googlesource.com/plugins/owners/",
     shallow_since = "1593642470 +0200",
 )
 
@@ -259,27 +266,25 @@
 
 http_archive(
     name = "com_github_kkos_oniguruma",
-    urls = ["https://github.com/kkos/oniguruma/releases/download/v6.9.5_rev1/onig-6.9.5_rev1.tar.gz"],
-    strip_prefix = "onig-6.9.5",
-    sha256 = "d33c849d1672af227944878cefe0a8fcf26fc62bedba32aa517f2f63c314a99e",
     build_file = "@hscloud//third_party/oniguruma:BUILD.external",
+    sha256 = "d33c849d1672af227944878cefe0a8fcf26fc62bedba32aa517f2f63c314a99e",
+    strip_prefix = "onig-6.9.5",
+    urls = ["https://github.com/kkos/oniguruma/releases/download/v6.9.5_rev1/onig-6.9.5_rev1.tar.gz"],
 )
 
 # jq, with build from //third_party/jq
 
 http_archive(
     name = "com_github_stedolan_jq",
-    urls = ["https://github.com/stedolan/jq/releases/download/jq-1.6/jq-1.6.tar.gz"],
-    strip_prefix = "jq-1.6",
-    sha256 = "5de8c8e29aaa3fb9cc6b47bb27299f271354ebb72514e3accadc7d38b5bbaa72",
     build_file = "@hscloud//third_party/jq:BUILD.external",
+    sha256 = "5de8c8e29aaa3fb9cc6b47bb27299f271354ebb72514e3accadc7d38b5bbaa72",
+    strip_prefix = "jq-1.6",
+    urls = ["https://github.com/stedolan/jq/releases/download/jq-1.6/jq-1.6.tar.gz"],
 )
 
 # leaflet.js from NPM, used by //hswaw/site.
 http_archive(
     name = "com_npmjs_leaflet",
-    urls = ["https://registry.npmjs.org/leaflet/-/leaflet-1.7.1.tgz"],
-    sha256 = "43aca726165904ff73a34571c263b561cec94e6b9992a4414a600f3e984d1b03",
     build_file_content = """
 filegroup(
     name = "distfiles",
@@ -295,4 +300,27 @@
     visibility = ["//visibility:public"],
 )
 """,
+    sha256 = "43aca726165904ff73a34571c263b561cec94e6b9992a4414a600f3e984d1b03",
+    urls = ["https://registry.npmjs.org/leaflet/-/leaflet-1.7.1.tgz"],
+)
+
+# noVNC, used by //dc/drackvm.
+http_archive(
+    name = "com_github_novnc_novnc",
+    build_file_content = """
+filegroup(
+    name = "distfiles",
+    srcs = [
+        "vnc.html",
+    ] + glob([
+        "app/**",
+        "core/**",
+        "vendor/**",
+    ]),
+    visibility = ["//visibility:public"],
+)
+""",
+    urls = ["https://github.com/novnc/noVNC/archive/refs/tags/v1.3.0-beta.tar.gz"],
+    sha256 = "2c972cca34376dfd2a54939e7e571e466511bf592d03e838440b3c8868441eaf",
+    strip_prefix = "noVNC-1.3.0-beta",
 )