diff --git a/.envrc b/.envrc
index 58ad4b3..f796b5b 100644
--- a/.envrc
+++ b/.envrc
@@ -1,29 +1,22 @@
 export PATH="$(git rev-parse --show-toplevel)/bin:$PATH"
 
-[[ -x bin/bazel ]] && exit
+fetch() {
+    direnv fetchurl "https://github.com/bazelbuild/bazelisk/releases/download/v1.10.1/bazelisk-$1-$2" "$3"
+}
 
-case $(uname -m) in
-    x86_64)
-        goarch=amd64;;
-    aarch64)
-        goarch=arm64;;
+case "$(uname | tr A-Z a-z)-$(uname -m)" in
+    linux-x86_64)
+        bzl=$(fetch linux amd64 sha256-TLU0xSzdR6YiPUWW1TDnyceFQ4qzsKSf80fpkcIQss0=);;
+    linux-aarch64)
+        bzl=$(fetch linux arm64 sha256-wd5oYN1PjV4uwnAJe9RtaiEblxoLizhVl4S9BR6pUKE=);;
+    darwin-x86_64)
+        bzl=$(fetch darwin arm64 sha256-wi1IYBRm2dOwQ8zXQFHy9CMPm59FCfCXAXyXMDqojRM=);;
+    darwin-aarch64)
+        bzl=$(fetch darwin arm64 sha256-5IW7+EUy0CpgsOsjxwJhC1QI3zoZkIek8rXgmVu/LVo=);;
     *)
-        >&2 echo "unsupported architecture $(uname -m)"
+        >&2 echo "unsupported architecture tuple $(uname | tr A-Z a-z)-$(uname -m)"
         exit 1;;
 esac
 
-bzl="bazelisk-$(uname | tr A-Z a-z)-${goarch}"
-
-rm -f "bin/$bzl"
-wget --no-verbose "https://github.com/bazelbuild/bazelisk/releases/download/v1.10.1/$bzl" \
-    -O "bin/$bzl"
-
-sha256sum -c --ignore-missing <<-EOF
-e485bbf84532d02a60b0eb23c702610b5408df3a199087a4f2b5e0995bbf2d5a  bin/bazelisk-darwin-amd64
-c22d48601466d9d3b043ccd74051f2f4230f9b9f4509f097017c97303aa88d13  bin/bazelisk-darwin-arm64
-4cb534c52cdd47a6223d4596d530e7c9c785438ab3b0a49ff347e991c210b2cd  bin/bazelisk-linux-amd64
-c1de6860dd4f8d5e2ec270097bd46d6a211b971a0b8b38559784bd051ea950a1  bin/bazelisk-linux-arm64
-EOF
-
-chmod a+x "bin/$bzl"
-mv "bin/$bzl" bin/bazel
+chmod a+x "${bzl}"
+ln -sf "${bzl}" bin/bazel