diff --git a/build/BUILD.bazel b/build/BUILD.bazel
index b83f4f487a5..f8e7fc4eefe 100644
--- a/build/BUILD.bazel
+++ b/build/BUILD.bazel
@@ -55,6 +55,7 @@ kong_rules_group(
         "@brotli",
         "@pcre",
         "@openresty",
+        "@lua",
     ],
     visibility = ["//visibility:public"],
 )
@@ -233,6 +234,12 @@ kong_rules_group(
     visibility = ["//visibility:public"],
 )
 
+kong_install(
+    name = "install-lua",
+    src = "@lua",
+    exclude = ["include"],  # skip install headers
+)
+
 # Wrap up : )
 
 kong_rules_group(
@@ -244,6 +251,7 @@ kong_rules_group(
         ":install-openresty",
         ":install-static-assets",
         ":install-tools",
+        ":install-lua",
     ],
     visibility = ["//visibility:public"],
 )
@@ -265,8 +273,10 @@ kong_genrule(
         rm -rf ${BUILD_DESTDIR}/share ${BUILD_DESTDIR}/lib ${BUILD_DESTDIR}/etc
         LUAROCKS=$(dirname '$(location @luarocks//:luarocks_make)')/luarocks_tree
         cp -r ${LUAROCKS}/share ${LUAROCKS}/lib ${LUAROCKS}/etc ${BUILD_DESTDIR}/.
-        cp ${LUAROCKS}/bin/luarocks ${BUILD_DESTDIR}/bin/.
-        cp ${LUAROCKS}/bin/luarocks-admin ${BUILD_DESTDIR}/bin/.
+
+        TARGET_LUAROCKS=$(dirname '$(location @luarocks//:luarocks_target)')/luarocks_tree
+        cp ${TARGET_LUAROCKS}/bin/luarocks ${BUILD_DESTDIR}/bin/.
+        cp ${TARGET_LUAROCKS}/bin/luarocks-admin ${BUILD_DESTDIR}/bin/.
 
         mkdir -p ${BUILD_DESTDIR}/etc/kong/
         cp ${WORKSPACE_PATH}/kong.conf.default ${BUILD_DESTDIR}/etc/kong/kong.conf.default
diff --git a/build/luarocks/BUILD.luarocks.bazel b/build/luarocks/BUILD.luarocks.bazel
index b23ad9609ba..1232db635e2 100644
--- a/build/luarocks/BUILD.luarocks.bazel
+++ b/build/luarocks/BUILD.luarocks.bazel
@@ -18,9 +18,8 @@ configure_make(
     configure_command = "configure",
     configure_in_place = True,
     configure_options = [
-        "--lua-suffix=jit",
-        "--with-lua=$$EXT_BUILD_DEPS/luajit",
-        "--with-lua-include=$$EXT_BUILD_DEPS/luajit/include/luajit-2.1",
+        "--with-lua=$$EXT_BUILD_DEPS/lua",
+        "--with-lua-include=$$EXT_BUILD_DEPS/lua/include",
     ],
     lib_source = ":all_srcs",
     out_bin_dir = "",
@@ -32,7 +31,7 @@ configure_make(
     ],
     visibility = ["//visibility:public"],
     deps = [
-        "@openresty//:luajit",
+        "@lua",
     ],
 )
 
@@ -46,6 +45,7 @@ kong_template_genrule(
         "//conditions:default": [
             "@luarocks//:luarocks_host",
             "@openresty//:luajit",
+            "@lua//:lua",
         ],
     }),
     is_executable = True,
@@ -58,6 +58,7 @@ kong_template_genrule(
         "@kong//:any-cross": [
             "@luarocks//:luarocks_host",
             "@openresty//:luajit",
+            "@lua//:lua",
         ],
         "//conditions:default": [],
     }),
@@ -86,6 +87,7 @@ kong_template_genrule(
         "//conditions:default": [
             "@luarocks//:luarocks_host",
             "@openresty//:luajit",
+            "@lua//:lua",
         ],
     }),
     is_executable = True,
@@ -102,6 +104,7 @@ kong_template_genrule(
         "@//:any-cross": [
             "@luarocks//:luarocks_host",
             "@openresty//:luajit",
+            "@lua//:lua",
         ],
         "//conditions:default": [],
     }),
diff --git a/build/luarocks/lua/BUILD.bazel b/build/luarocks/lua/BUILD.bazel
new file mode 100644
index 00000000000..700f4b4e248
--- /dev/null
+++ b/build/luarocks/lua/BUILD.bazel
@@ -0,0 +1,16 @@
+load("@bazel_skylib//rules:build_test.bzl", "build_test")
+
+exports_files(
+    [
+        "BUILD.lua.bazel",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+build_test(
+    name = "build",
+    targets = [
+        "@lua//:lua",
+    ],
+    visibility = ["//:__pkg__"],
+)
diff --git a/build/luarocks/lua/BUILD.lua.bazel b/build/luarocks/lua/BUILD.lua.bazel
new file mode 100644
index 00000000000..157b1d10eb8
--- /dev/null
+++ b/build/luarocks/lua/BUILD.lua.bazel
@@ -0,0 +1,38 @@
+load("@kong_bindings//:variables.bzl", "KONG_VAR")
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "make")
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(
+        include = ["**"],
+        exclude = ["*.bazel"],
+    ),
+)
+
+make(
+    name = "lua",
+    args = select({
+        "@platforms//os:macos": [
+            "AR=/usr/bin/ar",
+        ],
+        "//conditions:default": [
+        ],
+    }),
+    lib_source = ":all_srcs",
+    out_binaries = [
+        "lua",
+    ],
+    targets = [
+        "posix -j" + KONG_VAR["NPROC"],  # use posix instead linux to be able to cross compile
+        "install INSTALL_TOP=$$INSTALLDIR",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "lua_dir",
+    srcs = [
+        ":lua",
+    ],
+    output_group = "gen_dir",
+)
diff --git a/build/luarocks/lua/lua_repositories.bzl b/build/luarocks/lua/lua_repositories.bzl
new file mode 100644
index 00000000000..09b37b01cd6
--- /dev/null
+++ b/build/luarocks/lua/lua_repositories.bzl
@@ -0,0 +1,18 @@
+"""A module defining the third party dependency LUA"""
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+
+def lua_repositories():
+    maybe(
+        http_archive,
+        name = "lua",
+        build_file = "//build/luarocks/lua:BUILD.lua.bazel",
+        strip_prefix = "lua-5.1.5",
+        sha256 = "2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333",
+        urls = [
+            "https://www.lua.org/ftp/lua-5.1.5.tar.gz",
+        ],
+        patches = ["//build/luarocks/lua:patches/lua-cross.patch"],
+        patch_args = ["-p1"],
+    )
diff --git a/build/luarocks/lua/patches/lua-cross.patch b/build/luarocks/lua/patches/lua-cross.patch
new file mode 100644
index 00000000000..7ecf12231b4
--- /dev/null
+++ b/build/luarocks/lua/patches/lua-cross.patch
@@ -0,0 +1,13 @@
+diff --git a/src/Makefile b/src/Makefile
+index e0d4c9f..23f8273 100644
+--- a/src/Makefile
++++ b/src/Makefile
+@@ -7,7 +7,7 @@
+ # Your platform. See PLATS for possible values.
+ PLAT= none
+
+-CC= gcc
++CC?= gcc
+ CFLAGS= -O2 -Wall $(MYCFLAGS)
+ AR= ar rcu
+ RANLIB= ranlib
\ No newline at end of file
diff --git a/build/luarocks/luarocks_repositories.bzl b/build/luarocks/luarocks_repositories.bzl
index f62170365e6..b6f76012560 100644
--- a/build/luarocks/luarocks_repositories.bzl
+++ b/build/luarocks/luarocks_repositories.bzl
@@ -1,9 +1,12 @@
 """A module defining the third party dependency luarocks"""
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("//build/luarocks/lua:lua_repositories.bzl", "lua_repositories")
 load("@kong_bindings//:variables.bzl", "KONG_VAR")
 
 def luarocks_repositories():
+    lua_repositories()
+
     version = KONG_VAR["LUAROCKS"]
 
     http_archive(
diff --git a/build/luarocks/templates/luarocks_exec.sh b/build/luarocks/templates/luarocks_exec.sh
index 10515f8f0af..09894d86ec4 100644
--- a/build/luarocks/templates/luarocks_exec.sh
+++ b/build/luarocks/templates/luarocks_exec.sh
@@ -6,6 +6,7 @@ libxml2_path="invalid"
 openssl_path="{{@@openssl//:openssl}}"
 luarocks_host_path="{{@@luarocks//:luarocks_host}}"
 luajit_path="{{@@openresty//:luajit}}"
+lua_path="{{@@lua//:lua}}"
 kongrocks_path="invalid"
 cross_deps_libyaml_path="{{@@cross_deps_libyaml//:libyaml}}"
 CC={{CC}}
@@ -72,23 +73,28 @@ if [[ $CC != /* ]]; then
     LD=$root_path/$LD
 fi
 
-echo "
+cat << EOF > $ROCKS_CONFIG
 rocks_trees = {
     { name = [[system]], root = [[$ROCKS_DIR]] }
 }
-local_cache = '$CACHE_DIR'
-show_downloads = true
+lua_version = "5.1";
+lua_interpreter = "${luajit_path}/bin/luajit";
+local_cache = '$CACHE_DIR';
+show_downloads = true;
 gcc_rpath = false -- disable default rpath, add our own
 variables = {
     CC = '$CC',
     LD = '$LD',
     LDFLAGS = '-Wl,-rpath,$LIB_RPATH',
+    LUA_DIR = [[$root_path/$luajit_path]],
+    LUA_INCDIR = [[$root_path/$luajit_path/include/luajit-2.1]],
+    LUA_BINDIR = [[$root_path/$luajit_path/bin]]
 }
-" > $ROCKS_CONFIG
+EOF
 
 LUAROCKS_HOST=$luarocks_host_path
 
-host_luajit=$root_path/$luajit_path/bin/luajit
+host_lua=$root_path/$lua_path/bin/lua
 
 cat << EOF > $@
 LIB_RPATH=$LIB_RPATH
@@ -114,7 +120,7 @@ fi
 # force the interpreter here instead of invoking luarocks directly,
 # some distros has BINPRM_BUF_SIZE smaller than the shebang generated,
 # which is usually more than 160 bytes
-$host_luajit $root_path/$LUAROCKS_HOST/bin/luarocks \$private_rocks_args \$@ \\
+$host_lua $root_path/$LUAROCKS_HOST/bin/luarocks \$private_rocks_args \$@ \\
     OPENSSL_DIR=$OPENSSL_DIR \\
     CRYPTO_DIR=$OPENSSL_DIR \\
     EXPAT_DIR=$EXPAT_DIR \\
diff --git a/build/luarocks/templates/luarocks_target.sh b/build/luarocks/templates/luarocks_target.sh
index eb5791abf13..14453716fdd 100644
--- a/build/luarocks/templates/luarocks_target.sh
+++ b/build/luarocks/templates/luarocks_target.sh
@@ -7,6 +7,7 @@ build_destdir="{{build_destdir}}"
 
 luarocks_exec="{{@@luarocks//:luarocks_exec}}"
 luajit_path="{{@@openresty//:luajit}}"
+lua_path="{{@@lua//:lua}}"
 luarocks_host_path="{{@@luarocks//:luarocks_host}}"
 luarocks_wrap_script="{{@@//build/luarocks:luarocks_wrap_script.lua}}"
 # template variables ends
@@ -40,11 +41,12 @@ mkdir -p $rocks_tree/etc/luarocks
 cat << EOF > $rocks_tree/etc/luarocks/config-5.1.lua
 -- LuaRocks configuration
 rocks_trees = {
-        { name = "user", root = home .. "/.luarocks" };
-        { name = "system", root = "$install_destdir" };
-    }
-    lua_interpreter = "luajit";
-    variables = {
+    { name = "user", root = home .. "/.luarocks" };
+    { name = "system", root = "$install_destdir" };
+}
+lua_version = "5.1";
+lua_interpreter = "luajit";
+variables = {
     LUA_DIR = "$install_destdir/openresty/luajit";
     LUA_INCDIR = "$install_destdir/openresty/luajit/include/luajit-2.1";
     LUA_BINDIR = "$install_destdir/openresty/luajit/bin";
@@ -53,6 +55,7 @@ EOF
 
 sed -i -e "s|$build_destdir|$install_destdir|g" $rocks_tree/bin/luarocks
 sed -i -e "s|$rocks_tree|$install_destdir|g" $rocks_tree/bin/luarocks
+sed -i -e "s|openresty/luajit/bin/luajit|kong/bin/lua|" $rocks_tree/bin/luarocks
 
 # only generate the output when the command succeeds
 mv $@.tmp $@
diff --git a/build/templates/venv-commons b/build/templates/venv-commons
index f16a5aadbde..2e82b9e0ec9 100644
--- a/build/templates/venv-commons
+++ b/build/templates/venv-commons
@@ -32,6 +32,7 @@ echo "
 rocks_trees = {
     { name = [[system]], root = [[$ROCKS_ROOT]] }
 }
+lua_version = [[5.1]]
 " >| "$LUAROCKS_CONFIG"
 
 # duplicate package.[c]path even though we have set in resty-cli, so luajit and kong can consume
diff --git a/scripts/upgrade-tests/luarocks-system-lua b/scripts/upgrade-tests/luarocks-system-lua
new file mode 100755
index 00000000000..4d712ca2e48
--- /dev/null
+++ b/scripts/upgrade-tests/luarocks-system-lua
@@ -0,0 +1,38 @@
+#!/usr/bin/lua
+package.loaded["luarocks.core.hardcoded"] = { SYSCONFDIR = [[/usr/local/etc/luarocks]], LUA_VERSION = "5.1" }
+package.path=[[/usr/local/share/lua/5.1/?.lua;]] .. package.path
+local list = package.searchers or package.loaders; table.insert(list, 1, function(name) if name:match("^luarocks%.") then return loadfile([[/usr/local/share/lua/5.1/]] .. name:gsub([[%.]], [[/]]) .. [[.lua]]) end end)
+
+-- Load cfg first so that the loader knows it is running inside LuaRocks
+local cfg = require("luarocks.core.cfg")
+
+local loader = require("luarocks.loader")
+local cmd = require("luarocks.cmd")
+
+local description = "LuaRocks main command-line interface"
+
+local commands = {
+   init = "luarocks.cmd.init",
+   pack = "luarocks.cmd.pack",
+   unpack = "luarocks.cmd.unpack",
+   build = "luarocks.cmd.build",
+   install = "luarocks.cmd.install",
+   search = "luarocks.cmd.search",
+   list = "luarocks.cmd.list",
+   remove = "luarocks.cmd.remove",
+   make = "luarocks.cmd.make",
+   download = "luarocks.cmd.download",
+   path = "luarocks.cmd.path",
+   show = "luarocks.cmd.show",
+   new_version = "luarocks.cmd.new_version",
+   lint = "luarocks.cmd.lint",
+   write_rockspec = "luarocks.cmd.write_rockspec",
+   purge = "luarocks.cmd.purge",
+   doc = "luarocks.cmd.doc",
+   upload = "luarocks.cmd.upload",
+   config = "luarocks.cmd.config",
+   which = "luarocks.cmd.which",
+   test = "luarocks.cmd.test",
+}
+
+cmd.run_command(description, commands, "luarocks.cmd.external", ...)
diff --git a/scripts/upgrade-tests/test-upgrade-path.sh b/scripts/upgrade-tests/test-upgrade-path.sh
index 878c4c2f907..016cb7700a9 100755
--- a/scripts/upgrade-tests/test-upgrade-path.sh
+++ b/scripts/upgrade-tests/test-upgrade-path.sh
@@ -75,6 +75,9 @@ function prepare_container() {
     docker exec $1 apt-get install -y build-essential curl m4 unzip git
     docker exec $1 bash -c "ln -sf /usr/local/kong/include/* /usr/include"
     docker exec $1 bash -c "ln -sf /usr/local/kong/lib/* /usr/lib"
+    # the following two lines will not be needed on 3.11+
+    docker exec -u 0 $1 apt-get install -y lua5.1
+    docker cp scripts/upgrade-tests/luarocks-system-lua $1:/usr/local/bin/luarocks
 }
 
 function build_containers() {