diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 14e3426b32..9ced2a17cc 100644
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -2079,6 +2079,8 @@ axes:
         display_name: "RHEL 7.x"
         run_on: rhel79-small
         batchtime: 10080  # 7 days
+        variables:
+          SKIP_HATCH: true
       - id: rhel8
         display_name: "RHEL 8.x"
         run_on: rhel8.8-small
diff --git a/.evergreen/hatch.sh b/.evergreen/hatch.sh
index db0da2f4d0..57ae45308f 100644
--- a/.evergreen/hatch.sh
+++ b/.evergreen/hatch.sh
@@ -2,6 +2,8 @@
 set -o errexit  # Exit the script with error if any of the commands fail
 set -x
 
+source .evergreen/scripts/env.sh
+
 . .evergreen/utils.sh
 
 if [ -z "$PYTHON_BINARY" ]; then
@@ -15,23 +17,52 @@ if [ -n "$SKIP_HATCH" ]; then
     # shellcheck disable=SC2064
     trap "deactivate; rm -rf $ENV_NAME" EXIT HUP
     python -m pip install -e ".[test]"
-    run_hatch() {
-      bash ./.evergreen/run-tests.sh
-    }
-elif $PYTHON_BINARY -m hatch --version; then
-    run_hatch() {
-      $PYTHON_BINARY -m hatch run "$@"
-    }
-else # No toolchain hatch present, set up virtualenv before installing hatch
-    # Use a random venv name because the encryption tasks run this script multiple times in the same run.
-    ENV_NAME=hatchenv-$RANDOM
-    createvirtualenv "$PYTHON_BINARY" $ENV_NAME
-    # shellcheck disable=SC2064
-    trap "deactivate; rm -rf $ENV_NAME" EXIT HUP
-    python -m pip install -q hatch
-    run_hatch() {
-      python -m hatch run "$@"
-    }
+    bash ./.evergreen/run-tests.sh
+    exit 0
 fi
 
-run_hatch "${@:1}"
+# Bootstrap hatch if needed.
+if [ ! -f .bin/hatch ] && [ ! -f .bin/hatch.exe ] ; then
+  platform="$(uname -s)-$(uname -m)"
+  case $platform in
+    Linux-x86_64)
+      target=x86_64-unknown-linux-gnu.tar.gz
+      ;;
+    Linux-aarch64)
+      target=aarch64-unknown-linux-gnu.tar.gz
+      ;;
+    CYGWIN_NT*)
+      target=x86_64-pc-windows-msvc.zip
+      ;;
+    Darwin-x86_64)
+      target=x86_64-apple-darwin.tar.gz
+      ;;
+    Darwin-arm64)
+      target=aarch64-apple-darwin.tar.gz
+      ;;
+    *)
+      echo "Unsupported platform: $platform"
+      exit 1
+      ;;
+  esac
+  curl -L -o hatch.bin https://github.com/pypa/hatch/releases/download/hatch-v1.12.0/hatch-$target
+  mkdir -p .bin
+  if [ "${OS:-}" == "Windows_NT" ]; then
+    unzip hatch.bin
+    mv hatch.exe .bin
+    chmod +x .bin/hatch.exe
+    .bin/hatch.exe --version
+  else
+    tar xfz hatch.bin
+    mv hatch .bin
+    .bin/hatch --version
+  fi
+  rm hatch.bin
+fi
+
+export HATCH_PYTHON="$PYTHON_BINARY"
+if [ "${OS:-}" == "Windows_NT" ]; then
+  .bin/hatch.exe run "$@"
+else
+  .bin/hatch run "$@"
+fi
diff --git a/.gitignore b/.gitignore
index 69dd20efa3..635c0f92bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,7 @@ mongocryptd.pid
 .vscode/
 .nova/
 venv/
+.bin
 secrets-export.sh
 libmongocrypt.tar.gz
 libmongocrypt/