diff --git a/BUILD.bazel b/BUILD.bazel
index 390f5028..3df88aab 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -14,10 +14,7 @@ load("@rules_cc//cc:cc_library.bzl", "cc_library")
 #     entirely. `USE_BORINGSSL` ifdef-guards the two OpenSSL-only
 #     surfaces (`SSL_CONF_*` command API and `SSL_read_ex`) that
 #     BoringSSL doesn't provide; see clickhouse/base/sslsocket.cpp.
-#   * lz4 / zstd / abseil come from BCR modules instead of contrib/.
-#     cityhash is the exception: it is built from contrib/ because the
-#     wire protocol needs ClickHouse's frozen CityHash variant, which
-#     differs from the stock BCR module (see the :cityhash target).
+#   * lz4 / zstd / abseil / cityhash come from BCR modules instead of contrib/.
 
 # Selects the TLS implementation: `--@clickhouse-cpp//:tls=boringssl`
 # (default), `--@clickhouse-cpp//:tls=openssl`, or
@@ -67,34 +64,6 @@ selects.config_setting_group(
     ],
 )
 
-# Vendored CityHash from contrib/, NOT the BCR `@cityhash` module.
-# ClickHouse's wire protocol checksums compressed blocks with a specific
-# frozen CityHash128 variant (see clickhouse/base/compressed.cpp); the
-# stock Google CityHash 1.0.2 that BCR packages produces *different*
-# hashes, so a server rejects compressed blocks with "Checksum doesn't
-# match: corrupted data". This is the exact copy the CMake build uses,
-# guaranteeing byte-identical hashing and wire compatibility.
-cc_library(
-    name = "cityhash",
-    srcs = [
-        "contrib/cityhash/cityhash/city.cc",
-        "contrib/cityhash/cityhash/city_config.h",
-    ],
-    hdrs = [
-        "contrib/cityhash/cityhash/city.h",
-        "contrib/cityhash/cityhash/citycrc.h",
-    ],
-    # city_config.h gates __builtin_expect off with `#if WIN32 || WIN64`, but
-    # MSVC only predefines `_WIN32`/`_WIN64` — under CMake it's CMake that
-    # defines WIN32, which Bazel's MSVC toolchain doesn't. Define it here
-    # so the GCC/Clang-only builtin isn't used on MSVC.
-    copts = select({
-        "@platforms//os:windows": ["/DWIN32"],
-        "//conditions:default": [],
-    }),
-    strip_include_prefix = "contrib/cityhash/cityhash",
-)
-
 # The main clickhouse-cpp library. Downstream callers use
 # `#include <clickhouse/client.h>` and link `@clickhouse-cpp//:clickhouse`.
 cc_library(
@@ -157,7 +126,7 @@ cc_library(
     visibility = ["//visibility:public"],
     deps = [
         "@abseil-cpp//absl/numeric:int128",
-        ":cityhash",
+        "@cityhash//:cityhash",
         "@lz4//:lz4",
         "@zstd//:zstd",
     ] + select({
diff --git a/MODULE.bazel b/MODULE.bazel
index b1d7985f..c94b4b6e 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -7,6 +7,7 @@ module(name = "clickhouse-cpp", version = "2.6.2")
 bazel_dep(name = "abseil-cpp", version = "20260107.1")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "boringssl", version = "0.20260526.0")
+bazel_dep(name = "cityhash", version = "1.0.2.bcr.1")
 bazel_dep(name = "lz4", version = "1.10.0.bcr.1")
 bazel_dep(name = "openssl", version = "3.5.5.bcr.4")
 bazel_dep(name = "platforms", version = "1.1.0")