diff --git a/.bazelrc b/.bazelrc
index 1d0692abcc..d04fbc413c 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -18,8 +18,8 @@ common --experimental_platform_in_output_dir
 # Match Cargo's MSVC static CRT policy and V8's allocator linkage. Only the
 # MSVC C/C++ toolchain consumes this feature; other toolchains ignore it.
 # Include host dependencies so native build tools use the same runtime.
-build --features=static_link_msvcrt
-build --host_features=static_link_msvcrt
+build --features=-dynamic_link_msvcrt --features=static_link_msvcrt
+build --host_features=-dynamic_link_msvcrt --host_features=static_link_msvcrt
 
 build --workspace_status_command=./scripts/workspace-status.sh
 build:windows --workspace_status_command=./scripts/workspace-status.cmd
@@ -222,12 +222,11 @@ common:ci-v8 --config=ci
 common:ci-v8 --build_metadata=TAG_workflow=v8
 common:ci-v8 --build_metadata=TAG_os=linux
 
-# Native Windows MSVC builds inherit the runner's MSVC SDK environment.
+# Native Windows MSVC builds use the registered LLVM toolchain and its SDK.
+# Voice's separately declared native build tools still need the runner environment.
 # Client environment capture and repository discovery happen before target
 # transitions, so these runner settings cannot live in runtime_package.bzl.
-# Hermetic LLVM targets the GNU ABI on Windows even on an MSVC platform.
-build:ci-windows-msvc --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=0
-build:ci-windows-msvc --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows,@local_config_cc//:cc-toolchain-arm64_windows
+build:ci-windows-msvc --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1
 build:ci-windows-msvc --action_env=PATH
 build:ci-windows-msvc --host_action_env=PATH
 build:ci-windows-msvc --action_env=INCLUDE
diff --git a/.github/workflows/rust-release-windows.yml b/.github/workflows/rust-release-windows.yml
index cac95e6878..bbd9869460 100644
--- a/.github/workflows/rust-release-windows.yml
+++ b/.github/workflows/rust-release-windows.yml
@@ -260,8 +260,7 @@ jobs:
             -- \
             test --config=release \
             --platforms=//:local_windows_msvc \
-            --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows,@local_config_cc//:cc-toolchain-arm64_windows,//third_party/voice:windows_pkg_config_toolchain,//third_party/voice:windows_cmake_toolchain \
-            --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=0 \
+            --extra_toolchains=//third_party/voice:windows_pkg_config_toolchain,//third_party/voice:windows_cmake_toolchain \
             --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1 \
             --inject_repository="voice_windows_tools=$VOICE_WINDOWS_BAZEL_REPOSITORY" \
             --//third_party/voice:windows_installed_tools=@voice_windows_tools//:tools \
diff --git a/MODULE.bazel b/MODULE.bazel
index e248f79ee6..e513a2ddce 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -4,21 +4,34 @@ bazel_dep(name = "bazel_lib", version = "3.2.2")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 
+# Expose rules_rs's existing dependency for the openssl-sys replacement's SBOM.
+bazel_dep(name = "package_metadata", version = "0.0.7")
+
 # Expose the public protobuf rules already used transitively by rules_rs.
 bazel_dep(name = "protobuf", version = "34.0.bcr.1", repo_name = "com_google_protobuf")
+
+# Backport protobuf#31266 (849e1cbf91af): MSVC also needs the ARM64 SEH workaround.
+single_version_override(
+    module_name = "protobuf",
+    patch_strip = 1,
+    patches = ["//patches:protobuf_windows_arm64_seh.patch"],
+)
+
 bazel_dep(name = "llvm", version = "0.8.11")
 bazel_dep(name = "windows_support", version = "0.2.0")
+bazel_dep(name = "with_cfg.bzl", version = "0.12.0")
 
-# Patch hermetic LLVM for Codex's custom libc++ and Windows gnullvm runtime
-# needs that have not landed upstream.
-single_version_override(
+# Merged target-scoped C++ standard-library opt-outs for V8's private libc++.
+# https://github.com/hermeticbuild/hermetic-llvm/pull/903
+# Includes explicit MSVC CRT startup-library selection for dependency-provided main.
+# https://github.com/hermeticbuild/hermetic-llvm/pull/914
+archive_override(
     module_name = "llvm",
+    integrity = "sha256-KTjljFEA8dmXkOoVz6Wv3yqkMfqrbS5iDv/ef4GYsu0=",
     patch_strip = 1,
-    patches = [
-        "//patches:llvm_rusty_v8_custom_libcxx.patch",
-        "//patches:llvm_windows_arm64_powl.patch",
-        "//patches:llvm_windows_mingw_compat.patch",
-    ],
+    patches = ["//patches:llvm_mingw_import_warnings.patch"],
+    strip_prefix = "hermetic-llvm-d27493f0386c9d4d28f7b12630cb91b0cdfd20f1",
+    urls = ["https://github.com/hermeticbuild/hermetic-llvm/archive/d27493f0386c9d4d28f7b12630cb91b0cdfd20f1.tar.gz"],
 )
 
 # Preserve case-only SDK aliases when native Windows repository setup feeds
@@ -145,23 +158,10 @@ use_repo(osx, "macos_sdk")
 
 # Needed to disable xcode...
 bazel_dep(name = "apple_support", version = "2.1.0")
-bazel_dep(name = "rules_cc", version = "0.2.18")
-
-# Windows voice jobs explicitly select the installed MSVC C toolchains.
-cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
-use_repo(cc_configure, "local_config_cc")
-
-single_version_override(
-    module_name = "rules_cc",
-    patch_strip = 1,
-    patches = [
-        "//patches:rules_cc_windows_native_llvm.patch",
-    ],
-)
-
+bazel_dep(name = "rules_cc", version = "0.2.25")
 bazel_dep(name = "rules_platform", version = "0.1.0")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
-bazel_dep(name = "aws-lc", version = "5.1.0.bcr.1")
+bazel_dep(name = "aws-lc", version = "5.1.0.bcr.3")
 bazel_dep(name = "rules_rs", version = "0.0.96")
 bazel_dep(name = "rules_foreign_cc", version = "0.15.1")
 single_version_override(
@@ -204,35 +204,31 @@ use_repo(pip, "schema_python")
 register_toolchains("@rules_foreign_cc//toolchains:built_make_toolchain")
 
 foreign_cc_tools = use_extension("@rules_foreign_cc//foreign_cc:extensions.bzl", "tools")
-use_repo(foreign_cc_tools, "cmake-3.31.8-windows-x86_64", "pkgconfig_src")
+use_repo(foreign_cc_tools, "cmake-3.31.8-windows-x86_64", "ninja_1.13.0_win", "pkgconfig_src")
 
-single_version_override(
+register_toolchains("//third_party/voice:windows_ninja_toolchain")
+
+archive_override(
     module_name = "rules_rs",
+    integrity = "sha256-b8sUj9EvM72+so/q4uRH91ed7QwOO8EoGbdL8NyBjE4=",
     patch_strip = 1,
     patches = [
+        "//patches:rules_rs_bindgen_v0_0_4.patch",
         "//patches:rules_rs_build_script_deps_annotation.patch",
         "//patches:rules_rs_rust_debug_modes.patch",
-        "//patches:rules_rs_windows_msvc_linker.patch",
         "//patches:rules_rs_workspace_package_version.patch",
-        "//patches:rules_rs_zlib_snapshot_urls.patch",
     ],
-    version = "0.0.96",
+    strip_prefix = "rules_rs-7a05511772a8a85db5382ff7536bf2f1e6a8dde3",
+    urls = ["https://github.com/hermeticbuild/rules_rs/archive/7a05511772a8a85db5382ff7536bf2f1e6a8dde3.tar.gz"],
 )
 
 rules_rust = use_extension("@rules_rs//rs:rules_rust.bzl", "rules_rust")
 rules_rust.patch(
     patches = [
-        # Carry the OpenAI setup fix that makes build-script tools available
-        # through their runfiles after the rules_rs upgrade.
-        "//patches:rules_rust_build_script_tools_transition.patch",
         # Opt-in release profile compatibility for native Cargo build scripts.
         "//patches:rules_rust_release_build_script_profile.patch",
-        # Prefer Rust's direct linker for Windows/MSVC and keep hermetic
-        # LLVM's non-.lib runtime artifacts compatible with it.
-        "//patches:rules_rust_windows_msvc_direct_link_args.patch",
-        # Skip transient native-Windows linker outputs while consolidating
-        # dependency search paths.
-        "//patches:rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
+        # Refreshed upstream PR #92; forwarding comes from merged #102.
+        "//patches:rules_rust_declared_msvc_linker.patch",
         # Spill wrapper arguments to a params file to avoid Windows command-line limits.
         "//patches:rules_rust_process_wrapper_param_file.patch",
         "//patches:rules_rust_windows_execroot_separators.patch",
@@ -329,7 +325,7 @@ toolchains.toolchain(
 )
 use_repo(toolchains, "default_rust_toolchains")
 
-register_toolchains("@default_rust_toolchains//:all")
+register_toolchains("@default_rust_toolchains//...")
 
 register_toolchains("@rust_toolchains//:all")
 
@@ -385,6 +381,11 @@ crate.from_cargo(
 
 bazel_dep(name = "zstd", version = "1.5.7.bcr.2")
 
+crate.annotation(
+    # Debug builds must also embed assets instead of reading the worker's source tree.
+    crate = "rust-embed",
+    crate_features = ["debug-embed"],
+)
 crate.annotation(
     # Keep Windows proxy authentication aligned with codex-rs/.cargo/config.toml.
     build_script_env = {"CFLAGS": "-DCURL_ENABLE_NTLM"},
@@ -394,13 +395,18 @@ crate.annotation(
     # Daemon tests repeatedly hash large CLI binaries, even in fastbuild mode.
     # Optimize the native backends as well as the Rust implementation.
     build_script_env = {"OPT_LEVEL": "3"},
-    # The Windows lint toolchain cannot reliably materialize blake3's native x86 assembly archives.
     crate = "blake3",
-    crate_features_select = {
-        "x86_64-pc-windows-gnullvm": ["pure"],
-    },
     rustc_flags = ["-Copt-level=3"],
 )
+crate.annotation_select(
+    # Avoid native x86 assembly tools unavailable when cross-compiling Windows.
+    crate = "blake3",
+    crate_features = ["pure"],
+    triples = [
+        "x86_64-pc-windows-gnullvm",
+        "x86_64-pc-windows-msvc",
+    ],
+)
 
 # Match the CodeModeHost response-compression benchmark's zstd level.
 crate.annotation(
@@ -492,25 +498,6 @@ bazel_dep(name = "openssl", version = "3.5.4.bcr.0")
 
 inject_repo(crate, "xz")
 
-crate.annotation(
-    build_script_data = [
-        "@openssl//:gen_dir",
-    ],
-    # Build scripts compile in Bazel's exec configuration, so target-specific
-    # optional build deps are otherwise dropped for the musl release platforms.
-    build_script_deps = [
-        "@crates//:openssl-src-300.6.1+3.6.3",
-    ],
-    build_script_env = {
-        "OPENSSL_DIR": "$(execpath @openssl//:gen_dir)",
-        "OPENSSL_NO_VENDOR": "1",
-        "OPENSSL_STATIC": "1",
-    },
-    crate = "openssl-sys",
-    data = ["@openssl//:gen_dir"],
-    gen_build_script = "on",
-)
-
 inject_repo(crate, "openssl")
 
 crate.annotation(
@@ -539,6 +526,22 @@ crate.annotation(
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
+# Cargo keeps vendored OpenSSL for musl; Bazel already supplies its own OpenSSL.
+# Replace this crate's generated build, not Cargo's feature resolution.
+http_archive(
+    name = "openssl_sys_bazel",
+    build_file = "//third_party/openssl:openssl_sys.BUILD.bazel",
+    sha256 = "19c413d6ec9ebaf5e1c829d355cb3e9f783778d700f135be0921d52fce3c60ae",
+    strip_prefix = "openssl-sys-0.9.118",
+    type = "tar.gz",
+    urls = ["https://static.crates.io/crates/openssl-sys/openssl-sys-0.9.118.crate"],
+)
+
+override_repo(
+    crate,
+    **{"crates__openssl-sys-0.9.118": "openssl_sys_bazel"}
+)
+
 codex_release_archive = use_repo_rule("//bazel/extensions:codex_release_archive.bzl", "codex_release_archive")
 
 codex_release_archive(
@@ -557,6 +560,14 @@ new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.
 
 include("//bazel/modules:wine.MODULE.bazel")
 
+# Run V8's Windows snapshot generator natively or with the executor's Wine.
+bazel_dep(name = "rules_wine", version = "0.1.3")
+
+wine = use_extension("@rules_wine//wine/extension:wine.bzl", "wine")
+use_repo(wine, "wine_toolchains")
+
+register_toolchains("@wine_toolchains//:all")
+
 voice_sources = use_extension("//third_party/voice:extensions.bzl", "voice_sources")
 use_repo(
     voice_sources,
@@ -600,25 +611,29 @@ crate.annotation(
         "RUSTY_V8_SRC_BINDING_PATH": "$(execpath @v8_targets//:rusty_v8_binding_for_target)",
     },
     crate = "v8",
-    # Keep the Rust feature aligned with the sandbox archive/binding pairs.
-    crate_features_select = {
-        "aarch64-apple-darwin": ["v8_enable_sandbox"],
-        "aarch64-pc-windows-gnullvm": ["v8_enable_sandbox"],
-        "aarch64-pc-windows-msvc": ["v8_enable_sandbox"],
-        "aarch64-unknown-linux-gnu": ["v8_enable_sandbox"],
-        "aarch64-unknown-linux-musl": ["v8_enable_sandbox"],
-        "x86_64-apple-darwin": ["v8_enable_sandbox"],
-        "x86_64-pc-windows-gnullvm": ["v8_enable_sandbox"],
-        "x86_64-pc-windows-msvc": ["v8_enable_sandbox"],
-        "x86_64-unknown-linux-gnu": ["v8_enable_sandbox"],
-        "x86_64-unknown-linux-musl": ["v8_enable_sandbox"],
-    },
     gen_build_script = "on",
     patch_args = ["-p1"],
     patches = [
         "//patches:rusty_v8_prebuilt_out_dir.patch",
     ],
 )
+crate.annotation_select(
+    # Keep the Rust feature aligned with the sandbox archive/binding pairs.
+    crate = "v8",
+    crate_features = ["v8_enable_sandbox"],
+    triples = [
+        "aarch64-apple-darwin",
+        "aarch64-pc-windows-gnullvm",
+        "aarch64-pc-windows-msvc",
+        "aarch64-unknown-linux-gnu",
+        "aarch64-unknown-linux-musl",
+        "x86_64-apple-darwin",
+        "x86_64-pc-windows-gnullvm",
+        "x86_64-pc-windows-msvc",
+        "x86_64-unknown-linux-gnu",
+        "x86_64-unknown-linux-musl",
+    ],
+)
 
 inject_repo(crate, "v8_targets")
 
@@ -626,11 +641,17 @@ llvm = use_extension("@llvm//extensions:llvm.bzl", "llvm")
 use_repo(llvm, "llvm-project")
 
 crate.annotation(
-    # Disable SQLite intrinsics that can crash at startup on older x64 Windows CPUs.
-    build_script_env_select = {
-        "x86_64-pc-windows-msvc": '{"LIBSQLITE3_FLAGS": "SQLITE_DISABLE_INTRINSIC"}',
-    },
+    additive_build_file = "//third_party/sqlite:libsqlite3_sys.BUILD.bazel",
     crate = "libsqlite3-sys",
+    extra_aliased_targets = {
+        "libsqlite3_sys_bindings": "sqlite3/bindgen_bundled_version.rs",
+        "libsqlite3_sys_headers": "sqlite3_headers",
+        "libsqlite3_sys_source": "sqlite3/sqlite3.c",
+    },
+    gen_build_script = "off",
+    repositories = ["crates"],
+    version = "0.39.1",
+    deps = ["//third_party/sqlite:libsqlite3_sys_build_info"],
 )
 crate.annotation(
     # Provide the hermetic SDK path so the build script doesn't try to invoke an unhermetic `xcrun --show-sdk-path`.
@@ -672,7 +693,11 @@ crate.annotation(
     ],
     crate = "opusic-sys",
     patch_args = ["-p1"],
-    patches = ["//patches:opusic_sys_install_headers.patch"],
+    patches = [
+        "//patches:opusic_sys_install_headers.patch",
+        # Presuming NEON must include its implementations without requiring RTCD.
+        "//patches:opusic-sys_presume_neon.patch",
+    ],
 )
 
 # The musl CLI's allocator needs declared native tools and consistent header flags.
@@ -835,6 +860,7 @@ engine_repository(
         "//patches:v8_source_portability.patch",
         "//patches:v8_array_sort_elements_kind.patch",
         "//third_party/v8:v8_defs.patch",
+        "//third_party/v8:v8_windows_snapshot_wine.patch",
     ],
     strip_prefix = "v8-15.2.124.1",
     urls = ["https://github.com/v8/v8/archive/refs/tags/15.2.124.1.tar.gz"],
@@ -853,17 +879,6 @@ pip.parse(
 )
 use_repo(pip, "v8_python_deps")
 
-native_windows_llvm = use_repo_rule("//third_party/v8:native_windows.bzl", "native_windows_llvm")
-
-native_windows_llvm(name = "v8_native_windows_llvm")
-
-native_windows_cc = use_repo_rule("//third_party/v8:native_windows.bzl", "native_windows_cc")
-
-native_windows_cc(
-    name = "v8_native_windows_cc",
-    native_llvm = "@v8_native_windows_llvm//:BUILD.bazel",
-)
-
 v8_dependencies = use_extension("//third_party/v8:dependencies.bzl", "dependencies")
 use_repo(
     v8_dependencies,
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 9e7b48ada0..e829f764e9 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -24,11 +24,10 @@
     "https://bcr.bazel.build/modules/apple_support/1.24.1/MODULE.bazel": "f46e8ddad60aef170ee92b2f3d00ef66c147ceafea68b6877cb45bd91737f5f8",
     "https://bcr.bazel.build/modules/apple_support/1.24.2/MODULE.bazel": "0e62471818affb9f0b26f128831d5c40b074d32e6dda5a0d3852847215a41ca4",
     "https://bcr.bazel.build/modules/apple_support/2.1.0/MODULE.bazel": "b15c125dabed01b6803c129cd384de4997759f02f8ec90dc5136bcf6dfc5086a",
-    "https://bcr.bazel.build/modules/apple_support/2.1.0/source.json": "78064cfefe18dee4faaf51893661e0d403784f3efe88671d727cdcdc67ed8fb3",
-    "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.3.3/MODULE.bazel": "37c764292861c2f70314efa9846bb6dbb44fc0308903b3285da6528305450183",
-    "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.3.3/source.json": "605086bbc197743a0d360f7ddc550a1d4dfa0441bc807236e17170f636153348",
-    "https://bcr.bazel.build/modules/aws-lc/5.1.0.bcr.1/MODULE.bazel": "82300781422804ec45397555891b583bbaa21b97b5a8815e928e81089b7432bc",
-    "https://bcr.bazel.build/modules/aws-lc/5.1.0.bcr.1/source.json": "7d88fc6db323947a11d1638fe95185e9c733c337a1d1e7b50cdcf487e29ce56e",
+    "https://bcr.bazel.build/modules/apple_support/2.8.0/MODULE.bazel": "c45f5176057092afba0be6c48a9ea02101666802f8be536947e099e94757f8ed",
+    "https://bcr.bazel.build/modules/apple_support/2.8.0/source.json": "b7f6d87669c206adaa7d82cc44733349c63e341b80a0e049496ebd91d78c3472",
+    "https://bcr.bazel.build/modules/aws-lc/5.1.0.bcr.3/MODULE.bazel": "1a37c90d62306e5e4e910797a4ca0fc3baa9757f59c4bc0a9eec986575a994c4",
+    "https://bcr.bazel.build/modules/aws-lc/5.1.0.bcr.3/source.json": "7eb91be8193ac2c2770887ede60eeaa16434c8efa01afd76c9bb2096904f8b5d",
     "https://bcr.bazel.build/modules/bazel_features/1.1.1/MODULE.bazel": "27b8c79ef57efe08efccbd9dd6ef70d61b4798320b8d3c134fd571f78963dbcd",
     "https://bcr.bazel.build/modules/bazel_features/1.10.0/MODULE.bazel": "f75e8807570484a99be90abcd52b5e1f390362c258bcb73106f4544957a48101",
     "https://bcr.bazel.build/modules/bazel_features/1.11.0/MODULE.bazel": "f9382337dd5a474c3b7d334c2f83e50b6eaedc284253334cf823044a26de03e8",
@@ -50,7 +49,6 @@
     "https://bcr.bazel.build/modules/bazel_features/1.42.1/MODULE.bazel": "275a59b5406ff18c01739860aa70ad7ccb3cfb474579411decca11c93b951080",
     "https://bcr.bazel.build/modules/bazel_features/1.43.0/MODULE.bazel": "defa2226f06ba20550d6548c3a2ea2a7929634437a52973869c20c225450eb91",
     "https://bcr.bazel.build/modules/bazel_features/1.45.0/MODULE.bazel": "7daec6d87ab0703417486d4cb948af0b06f55d4d7c08cbb5978c80e79b538edf",
-    "https://bcr.bazel.build/modules/bazel_features/1.47.0/MODULE.bazel": "e34df3cb35b1684cfa69923a61ae3803595babd3942cd306a488d51400886b30",
     "https://bcr.bazel.build/modules/bazel_features/1.50.0/MODULE.bazel": "2083ef9c7a469f520890483ccf8e0189d6e71e2117e7752e15e6554433d5ae3e",
     "https://bcr.bazel.build/modules/bazel_features/1.50.0/source.json": "e0ee3debde2789ff56e4452e612d126925ba9ab64d4bde79c67f099d2902df9b",
     "https://bcr.bazel.build/modules/bazel_features/1.9.0/MODULE.bazel": "885151d58d90d8d9c811eb75e3288c11f850e1d6b481a8c9f766adee4712358b",
@@ -63,6 +61,7 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.2.0/MODULE.bazel": "44fe84260e454ed94ad326352a698422dbe372b21a1ac9f3eab76eb531223686",
     "https://bcr.bazel.build/modules/bazel_skylib/1.2.1/MODULE.bazel": "f35baf9da0efe45fa3da1696ae906eea3d615ad41e2e3def4aeb4e8bc0ef9a7a",
     "https://bcr.bazel.build/modules/bazel_skylib/1.3.0/MODULE.bazel": "20228b92868bf5cfc41bda7afc8a8ba2a543201851de39d990ec957b513579c5",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.4.0/MODULE.bazel": "2ab127ef8d56a739a99bb2ce00ec4c7d1ecc7977d4370c0ca6efd0d8f03d6d99",
     "https://bcr.bazel.build/modules/bazel_skylib/1.4.1/MODULE.bazel": "a0dcb779424be33100dcae821e9e27e4f2901d9dfd5333efe5ac6a8d7ab75e1d",
     "https://bcr.bazel.build/modules/bazel_skylib/1.4.2/MODULE.bazel": "3bd40978e7a1fac911d5989e6b09d8f64921865a45822d8b09e815eaa726a651",
     "https://bcr.bazel.build/modules/bazel_skylib/1.5.0/MODULE.bazel": "32880f5e2945ce6a03d1fbd588e9198c0a959bb42297b2cfaf1685b7bc32e138",
@@ -73,7 +72,8 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/MODULE.bazel": "88ade7293becda963e0e3ea33e7d54d3425127e0a326e0d17da085a5f1f03ff6",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/MODULE.bazel": "69ad6927098316848b34a9142bcc975e018ba27f08c4ff403f50c1b6e646ca67",
     "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/MODULE.bazel": "72997b29dfd95c3fa0d0c48322d05590418edef451f8db8db5509c57875fb4b7",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/source.json": "7ad77c1e8c1b84222d9b3f3cae016a76639435744c19330b0b37c0a3c9da7dc0",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.2/MODULE.bazel": "8c51259b0f4481475586dbfede7591e57b75702e637f840f6138eec80c34b270",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.2/source.json": "41cbde7546542dee2f26e3f10bf1c4ac57909943194b7ac48cc5238a01893aa8",
     "https://bcr.bazel.build/modules/buildozer/8.5.1/MODULE.bazel": "a35d9561b3fc5b18797c330793e99e3b834a473d5fbd3d7d7634aafc9bdb6f8f",
     "https://bcr.bazel.build/modules/buildozer/8.5.1/source.json": "e3386e6ff4529f2442800dee47ad28d3e6487f36a1f75ae39ae56c70f0cd2fbd",
     "https://bcr.bazel.build/modules/bzip2/1.0.8.bcr.3/MODULE.bazel": "29ecf4babfd3c762be00d7573c288c083672ab60e79c833ff7f49ee662e54471",
@@ -88,21 +88,26 @@
     "https://bcr.bazel.build/modules/googletest/1.17.0.bcr.2/MODULE.bazel": "827f54f492a3ce549c940106d73de332c2b30cebd0c20c0bc5d786aba7f116cb",
     "https://bcr.bazel.build/modules/googletest/1.17.0.bcr.2/source.json": "3664514073a819992320ffbce5825e4238459df344d8b01748af2208f8d2e1eb",
     "https://bcr.bazel.build/modules/googletest/1.17.0/MODULE.bazel": "dbec758171594a705933a29fcf69293d2468c49ec1f2ebca65c36f504d72df46",
+    "https://bcr.bazel.build/modules/hermetic_launcher/0.0.17/MODULE.bazel": "afa67883ae04001c93578f80c39e5ec9231ae670978bc380778baf66e1936ad5",
+    "https://bcr.bazel.build/modules/hermetic_launcher/0.0.17/source.json": "46ee01ccb275e46f59a3c070f91be52eb113405efe577a99365dd69f168713ef",
     "https://bcr.bazel.build/modules/hermetic_launcher/0.0.8/MODULE.bazel": "3be7b0faca6f1e69e89197999e0b01ce058c42f3e764ef028466f7e0ff77c761",
-    "https://bcr.bazel.build/modules/hermetic_launcher/0.0.8/source.json": "8403718636114198fca6ea04b437fa001ac7167b4d485102defb0a6f7d11bc08",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.5/MODULE.bazel": "31271aedc59e815656f5736f282bb7509a97c7ecb43e927ac1a37966e0578075",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/MODULE.bazel": "2f8d20d3b7d54143213c4dfc3d98225c42de7d666011528dc8fe91591e2e17b0",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/source.json": "a04756d367a2126c3541682864ecec52f92cdee80a35735a3cb249ce015ca000",
     "https://bcr.bazel.build/modules/libcap/2.27.bcr.1/MODULE.bazel": "7c034d7a4d92b2293294934377f5d1cbc88119710a11079fa8142120f6f08768",
     "https://bcr.bazel.build/modules/libcap/2.27.bcr.1/source.json": "3b116cbdbd25a68ffb587b672205f6d353a4c19a35452e480d58fc89531e0a10",
     "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
-    "https://bcr.bazel.build/modules/llvm/0.8.11/MODULE.bazel": "0f8c30b74be64f0e91764e925d0f562c70e8d85b6cea912f724d6b3753d6a33f",
-    "https://bcr.bazel.build/modules/llvm/0.8.11/source.json": "b40edb2bb2ed271bf613b396d245cb473c42fb057a2b26a3bc7d7e8bfcf6aa71",
-    "https://bcr.bazel.build/modules/llvm/0.8.9/MODULE.bazel": "9e35ff5bcac996f9edc1b44b8f8baa58c7855e742c5608b07d925dcdbe642100",
+    "https://bcr.bazel.build/modules/libxml2/2.15.3/MODULE.bazel": "a6bffafd8aa8b0c13eaa4bf25d55be188ec8548549395f03e98c39bab264adaa",
+    "https://bcr.bazel.build/modules/libxml2/2.15.3/source.json": "fd7c420cb14981416c9fadd0db555bd1e249355e0e5b63b2ce15b92996b5fbfb",
+    "https://bcr.bazel.build/modules/mimalloc/3.5.3/MODULE.bazel": "d4555726ceff5240bef25b0ec38b1c80c68337eec2b4b5df20cf611df1383e6a",
+    "https://bcr.bazel.build/modules/mimalloc/3.5.3/source.json": "e94e4baf53f881236b86b16c436c6ab4a338b37135e370154802a7111c0dda28",
+    "https://bcr.bazel.build/modules/nlohmann_json/3.12.0.bcr.2/MODULE.bazel": "5c5596def463aeee17e5a4848a50f02f0cf4a351fc2f0dcc4444f1d87d2d3b08",
+    "https://bcr.bazel.build/modules/nlohmann_json/3.12.0.bcr.2/source.json": "2b8823c08a9b22f5d516619e437059e449159e7472bffba256cced8ba74643b5",
     "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/MODULE.bazel": "6f7b417dcc794d9add9e556673ad25cb3ba835224290f4f848f8e2db1e1fca74",
     "https://bcr.bazel.build/modules/openssl/3.5.4.bcr.0/MODULE.bazel": "0f6b8f20b192b9ff0781406256150bcd46f19e66d807dcb0c540548439d6fc35",
     "https://bcr.bazel.build/modules/openssl/3.5.4.bcr.0/source.json": "543ed7627cc18e6460b9c1ae4a1b6b1debc5a5e0aca878b00f7531c7186b73da",
     "https://bcr.bazel.build/modules/package_metadata/0.0.3/MODULE.bazel": "77890552ecea9e284b5424c9de827a58099348763a4359e975c359a83d4faa83",
+    "https://bcr.bazel.build/modules/package_metadata/0.0.6/MODULE.bazel": "341dab6f417197494517d54c8e557c0baee1de7aec83543a4fbefe57900acb7e",
     "https://bcr.bazel.build/modules/package_metadata/0.0.7/MODULE.bazel": "7adb03933fc8401f495800cf4eafcff0edc6da0ff55c7db223ef69d19f689486",
     "https://bcr.bazel.build/modules/package_metadata/0.0.7/source.json": "50639625e937b56115012674c797cca7a05a96b4878c87d803c13dc2b31de8a0",
     "https://bcr.bazel.build/modules/platforms/0.0.10/MODULE.bazel": "8cb8efaf200bdeb2150d93e162c40f388529a25852b332cec879373771e48ed5",
@@ -162,11 +167,12 @@
     "https://bcr.bazel.build/modules/rules_cc/0.2.16/MODULE.bazel": "9242fa89f950c6ef7702801ab53922e99c69b02310c39fb6e62b2bd30df2a1d4",
     "https://bcr.bazel.build/modules/rules_cc/0.2.17/MODULE.bazel": "1849602c86cb60da8613d2de887f9566a6d354a6df6d7009f9d04a14402f9a84",
     "https://bcr.bazel.build/modules/rules_cc/0.2.18/MODULE.bazel": "4460ec36adc8f722a6a2a4ac9374cb91f2acebadaa93fc37966129afb3dece87",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.19/MODULE.bazel": "d5e0f05b63273281a16654eb6b1a8742a75ec153ac8b4f0419949d6e401e46f0",
     "https://bcr.bazel.build/modules/rules_cc/0.2.20/MODULE.bazel": "f5c07bce5ddcb99be21a0812ff5aadb439e688b7449c6542152363b2fd859c1a",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.20/source.json": "1155433dc6b8161bc339ce94095b337ed95feb1f048b014e10b62339d4b4239c",
+    "https://bcr.bazel.build/modules/rules_cc/0.2.25/MODULE.bazel": "4a3d4f3606d3b3190be495dbc497acca552807d1d5540661ef0d1658472882e3",
+    "https://bcr.bazel.build/modules/rules_cc/0.2.25/source.json": "8df28a9a97b878fe45f0a4f4adf019869dda51a60ee2f6e15a0c79656a25058d",
     "https://bcr.bazel.build/modules/rules_cc/0.2.4/MODULE.bazel": "1ff1223dfd24f3ecf8f028446d4a27608aa43c3f41e346d22838a4223980b8cc",
     "https://bcr.bazel.build/modules/rules_cc/0.2.8/MODULE.bazel": "f1df20f0bf22c28192a794f29b501ee2018fa37a3862a1a2132ae2940a23a642",
+    "https://bcr.bazel.build/modules/rules_cc/0.2.9/MODULE.bazel": "34263f1dca62ea664265438cef714d7db124c03e1ed55ebb4f1dc860164308d1",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.15.1/MODULE.bazel": "c2c60d26c79fda484acb95cdbec46e89d6b28b4845cb277160ce1e0c8622bb88",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.15.1/source.json": "a161811a63ba8a859086da3b7ff3ad04f2e9c255d7727b41087103fc0eb22f55",
     "https://bcr.bazel.build/modules/rules_fuzzing/0.5.2/MODULE.bazel": "40c97d1144356f52905566c55811f13b299453a14ac7769dfba2ac38192337a8",
@@ -224,19 +230,21 @@
     "https://bcr.bazel.build/modules/rules_python/1.6.0/MODULE.bazel": "7e04ad8f8d5bea40451cf80b1bd8262552aa73f841415d20db96b7241bd027d8",
     "https://bcr.bazel.build/modules/rules_python/1.6.3/MODULE.bazel": "a7b80c42cb3de5ee2a5fa1abc119684593704fcd2fec83165ebe615dec76574f",
     "https://bcr.bazel.build/modules/rules_python/1.7.0/MODULE.bazel": "d01f995ecd137abf30238ad9ce97f8fc3ac57289c8b24bd0bf53324d937a14f8",
+    "https://bcr.bazel.build/modules/rules_python/1.8.0/MODULE.bazel": "c151c025dbcc93d8f62ab68ecc313c9176a868a0e6386981bf2a12aec77cbe7b",
     "https://bcr.bazel.build/modules/rules_python/2.4.2/MODULE.bazel": "fde4307b6765b6f261c40a2c08140a5d10e3aa9b6c12e23bb57d31b7ce124c29",
     "https://bcr.bazel.build/modules/rules_python/2.4.2/source.json": "225828a44c27fa97ba8a594e6fd3b752061779f052d40c4bb5d6b45f2ded567b",
-    "https://bcr.bazel.build/modules/rules_rs/0.0.96/MODULE.bazel": "678fdcee5a9847611276770eab47190dda04a41973b7bf6037e50a3f98e49e09",
-    "https://bcr.bazel.build/modules/rules_rs/0.0.96/source.json": "2b52d3d209324bd4aaa4896aa0e8b28d0123856b4ade32ebd7bf24b4fded6f12",
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
     "https://bcr.bazel.build/modules/rules_shell/0.4.1/MODULE.bazel": "00e501db01bbf4e3e1dd1595959092c2fadf2087b2852d3f553b5370f5633592",
     "https://bcr.bazel.build/modules/rules_shell/0.6.1/MODULE.bazel": "72e76b0eea4e81611ef5452aa82b3da34caca0c8b7b5c0c9584338aa93bae26b",
-    "https://bcr.bazel.build/modules/rules_shell/0.6.1/source.json": "20ec05cd5e592055e214b2da8ccb283c7f2a421ea0dc2acbf1aa792e11c03d0c",
+    "https://bcr.bazel.build/modules/rules_shell/0.8.0/MODULE.bazel": "f6a89f1d6a669a26f28fe814503857055d76306b79cfc11d12399af08d0b80ae",
+    "https://bcr.bazel.build/modules/rules_shell/0.8.0/source.json": "eb53cc815bc503c6683c5fe12d943f98883f81fc22f51403ec8a95610cba4195",
     "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca",
     "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046",
     "https://bcr.bazel.build/modules/rules_swift/2.4.0/MODULE.bazel": "1639617eb1ede28d774d967a738b4a68b0accb40650beadb57c21846beab5efd",
     "https://bcr.bazel.build/modules/rules_swift/3.1.2/MODULE.bazel": "72c8f5cf9d26427cee6c76c8e3853eb46ce6b0412a081b2b6db6e8ad56267400",
+    "https://bcr.bazel.build/modules/rules_wine/0.1.3/MODULE.bazel": "c4de7ea3fc70de78acf12afa9edc368de3678c924e6f7eb82d1c881d7f8b1265",
+    "https://bcr.bazel.build/modules/rules_wine/0.1.3/source.json": "c1a966ed7f4ab06355ce116ccb74685acc0d02d5463b46cb01f0c67cb0787600",
     "https://bcr.bazel.build/modules/sed/4.9.bcr.3/MODULE.bazel": "3aca45895b85b6ef65366cc12a45217ba6870f8931d2d62e09c99c772d9736ab",
     "https://bcr.bazel.build/modules/sed/4.9.bcr.3/source.json": "31c0cf4c135ed3fa58298cd7bcfd4301c54ea4cf59d7c4e2ea0a180ce68eb34f",
     "https://bcr.bazel.build/modules/stardoc/0.5.1/MODULE.bazel": "1a05d92974d0c122f5ccf09291442580317cdd859f07a8655f1db9a60374f9f8",
@@ -257,37 +265,19 @@
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/source.json": "3f3fbaeafecaf629877ad152a2c9def21f8d330d91aa94c5dc75bbb98c10b8b8",
     "https://bcr.bazel.build/modules/xz/5.4.5.bcr.8/MODULE.bazel": "e48a69bd54053c2ec5fffc2a29fb70122afd3e83ab6c07068f63bc6553fa57cc",
     "https://bcr.bazel.build/modules/xz/5.4.5.bcr.8/source.json": "bd7e928ccd63505b44f4784f7bbf12cc11f9ff23bf3ca12ff2c91cd74846099e",
+    "https://bcr.bazel.build/modules/zlib-ng/2.3.3.bcr.2/MODULE.bazel": "86130924115bf8dfc4aba286fb49a2ec8d32430a21771db9ccf5381acf0d10cc",
+    "https://bcr.bazel.build/modules/zlib-ng/2.3.3.bcr.2/source.json": "7aa4112eb2fbb99757e97cf0b7a4e2bdb3464b2b3cfb351bc807ffcb34bd349f",
     "https://bcr.bazel.build/modules/zlib/1.2.11/MODULE.bazel": "07b389abc85fdbca459b69e2ec656ae5622873af3f845e1c9d80fe179f3effa0",
     "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/MODULE.bazel": "eec517b5bbe5492629466e11dae908d043364302283de25581e3eb944326c4ca",
     "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.8/MODULE.bazel": "772c674bb78a0342b8caf32ab5c25085c493ca4ff08398208dcbe4375fe9f776",
     "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.8/source.json": "cf377d76800dfc3d3b71e9dd4a8c53a62837cbce37cc4f25e6207b15fc1e8f2b",
     "https://bcr.bazel.build/modules/zlib/1.3.1/MODULE.bazel": "751c9940dcfe869f5f7274e1295422a34623555916eb98c174c1e945594bf198",
+    "https://bcr.bazel.build/modules/zstd/1.5.7.bcr.1/MODULE.bazel": "c5977176dd8555be7a9d598512ae0cae11831259c06f00a5e5e0037d5db4e3f5",
     "https://bcr.bazel.build/modules/zstd/1.5.7.bcr.2/MODULE.bazel": "d20bf700aacefca7c09840baa4bae9b347ddb31bd9125f4e592998f80b980cd7",
     "https://bcr.bazel.build/modules/zstd/1.5.7.bcr.2/source.json": "19cf972e5efc777e24008b90c2d819a4c814d33d1326c62d736ed97544817bf0"
   },
   "selectedYankedVersions": {},
   "moduleExtensions": {
-    "@@aspect_tools_telemetry+//:extension.bzl%telemetry": {
-      "general": {
-        "bzlTransitiveDigest": "cl5A2O84vDL6Tt+Qga8FCj1DUDGqn+e7ly5rZ+4xvcc=",
-        "usagesDigest": "Miy0EWu0H7wJMzfdekpzuz3TBOzJz0l6aNIq2pL6k2g=",
-        "recordedInputs": [
-          "REPO_MAPPING:aspect_tools_telemetry+,bazel_lib bazel_lib+",
-          "REPO_MAPPING:aspect_tools_telemetry+,bazel_skylib bazel_skylib+"
-        ],
-        "generatedRepoSpecs": {
-          "aspect_tools_telemetry_report": {
-            "repoRuleId": "@@aspect_tools_telemetry+//:extension.bzl%tel_repository",
-            "attributes": {
-              "deps": {
-                "rules_rs": "0.0.96",
-                "aspect_tools_telemetry": "0.3.3"
-              }
-            }
-          }
-        }
-      }
-    },
     "@@protobuf+//python/dist:system_python.bzl%system_python_extension": {
       "general": {
         "bzlTransitiveDigest": "pmsA+awieucfllLc2n7k8xEoPp0i5LF9Hw6mGX0cqSQ=",
@@ -413,7 +403,7 @@
     "@@windows_support+//windows:extensions.bzl%msvc_runtime": {
       "general": {
         "bzlTransitiveDigest": "hSBf9aCBJn12Lq4IKLqoUFuySmukaarmyjhYNGlHMX0=",
-        "usagesDigest": "XZ1DGFYwC06tBdgHxuZLhTfFlPFVKjmYmiBfiY2xe3c=",
+        "usagesDigest": "Wycz6MuhJkgFnFKT74nNjAB8lDNj/DZxNJp+NLqkIII=",
         "recordedInputs": [
           "REPO_MAPPING:windows_support+,bazel_tools bazel_tools"
         ],
@@ -444,7 +434,7 @@
     "@@windows_support+//windows:extensions.bzl%windows_sdk": {
       "general": {
         "bzlTransitiveDigest": "hSBf9aCBJn12Lq4IKLqoUFuySmukaarmyjhYNGlHMX0=",
-        "usagesDigest": "M5xde76Im8TfiBsVtKQIavNOkqfp1QsjwJD4fVrrtFs=",
+        "usagesDigest": "fTIVqkpB+CwNlT/+OWVe6OAlNwEQixGYGJ+y+TLh3cM=",
         "recordedInputs": [
           "REPO_MAPPING:windows_support+,bazel_tools bazel_tools"
         ],
@@ -1398,6 +1388,17 @@
       "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c_sqlx-core": "{\"dependencies\":[{\"default_features\":true,\"features\":[],\"name\":\"async-fs\",\"optional\":true,\"req\":\"2.1\"},{\"default_features\":false,\"features\":[\"async-io\"],\"name\":\"async-global-executor\",\"optional\":true,\"req\":\"3.1\"},{\"default_features\":true,\"features\":[],\"name\":\"async-io\",\"optional\":true,\"req\":\"2.4.1\"},{\"default_features\":true,\"features\":[],\"name\":\"async-std\",\"optional\":true,\"req\":\"1.13\"},{\"default_features\":true,\"features\":[],\"name\":\"async-task\",\"optional\":true,\"req\":\"4.7.1\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"base64\",\"optional\":false,\"req\":\"0.22.1\"},{\"name\":\"bigdecimal\",\"optional\":true,\"req\":\"0.4.0\"},{\"name\":\"bit-vec\",\"optional\":true,\"req\":\"0.8\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"bstr\",\"optional\":true,\"req\":\"1.0.1\"},{\"name\":\"bytes\",\"req\":\"1.2.0\"},{\"name\":\"cfg-if\",\"req\":\"1.0.0\"},{\"default_features\":false,\"features\":[\"std\",\"clock\"],\"name\":\"chrono\",\"optional\":true,\"req\":\"0.4.34\"},{\"default_features\":true,\"features\":[],\"name\":\"crc\",\"optional\":true,\"req\":\"3\"},{\"name\":\"crossbeam-queue\",\"req\":\"0.3.2\"},{\"name\":\"either\",\"req\":\"1.6.1\"},{\"name\":\"event-listener\",\"req\":\"5.2.0\"},{\"default_features\":false,\"features\":[],\"name\":\"futures-core\",\"optional\":false,\"req\":\"0.3.32\"},{\"name\":\"futures-intrusive\",\"req\":\"0.5.0\"},{\"name\":\"futures-io\",\"req\":\"0.3.32\"},{\"default_features\":false,\"features\":[\"alloc\",\"sink\",\"io\"],\"name\":\"futures-util\",\"optional\":false,\"req\":\"0.3.32\"},{\"name\":\"hashbrown\",\"req\":\"0.16.0\"},{\"name\":\"hashlink\",\"req\":\"0.11.0\"},{\"name\":\"indexmap\",\"req\":\"2.0\"},{\"name\":\"ipnet\",\"optional\":true,\"req\":\"2.3.0\"},{\"name\":\"ipnetwork\",\"optional\":true,\"req\":\"0.21.1\"},{\"default_features\":false,\"features\":[],\"name\":\"log\",\"optional\":false,\"req\":\"0.4.18\"},{\"name\":\"mac_address\",\"optional\":true,\"req\":\"1.1.5\"},{\"default_features\":false,\"features\":[],\"name\":\"memchr\",\"optional\":false,\"req\":\"2.5.0\"},{\"default_features\":true,\"features\":[],\"name\":\"native-tls\",\"optional\":true,\"req\":\"0.2.10\"},{\"name\":\"percent-encoding\",\"req\":\"2.3.0\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"rust_decimal\",\"optional\":true,\"req\":\"1.36.0\"},{\"default_features\":false,\"features\":[\"std\",\"tls12\"],\"name\":\"rustls\",\"optional\":true,\"req\":\"0.23.24\"},{\"default_features\":true,\"features\":[],\"name\":\"rustls-native-certs\",\"optional\":true,\"req\":\"0.8.0\"},{\"default_features\":true,\"features\":[\"derive\",\"rc\"],\"name\":\"serde\",\"optional\":true,\"req\":\"1.0.219\"},{\"default_features\":true,\"features\":[\"raw_value\"],\"name\":\"serde_json\",\"optional\":true,\"req\":\"1.0.142\"},{\"default_features\":false,\"features\":[],\"name\":\"sha2\",\"optional\":true,\"req\":\"0.11.0\"},{\"name\":\"smallvec\",\"req\":\"1.13.1\"},{\"default_features\":false,\"features\":[],\"name\":\"smol\",\"optional\":true,\"req\":\"2.0\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"thiserror\",\"optional\":false,\"req\":\"2.0.18\"},{\"default_features\":true,\"features\":[\"formatting\",\"parsing\",\"macros\"],\"name\":\"time\",\"optional\":true,\"req\":\"0.3.48\"},{\"default_features\":false,\"features\":[\"time\",\"net\",\"sync\",\"fs\",\"io-util\",\"rt\"],\"name\":\"tokio\",\"optional\":true,\"req\":\"1.25.0\"},{\"default_features\":true,\"features\":[\"fs\"],\"name\":\"tokio-stream\",\"optional\":true,\"req\":\"0.1.8\"},{\"default_features\":true,\"features\":[],\"name\":\"toml\",\"optional\":true,\"req\":\"0.8.16\"},{\"default_features\":true,\"features\":[\"log\"],\"name\":\"tracing\",\"optional\":false,\"req\":\"0.1.37\"},{\"default_features\":true,\"features\":[],\"name\":\"url\",\"optional\":false,\"req\":\"2.2.2\"},{\"name\":\"uuid\",\"optional\":true,\"req\":\"1.12.1\"},{\"default_features\":true,\"features\":[],\"name\":\"webpki-roots\",\"optional\":true,\"req\":\"1\"}],\"features\":{\"_rt-async-global-executor\":[\"async-global-executor\",\"_rt-async-io\",\"_rt-async-task\"],\"_rt-async-io\":[\"async-io\",\"async-fs\"],\"_rt-async-std\":[\"async-std\",\"_rt-async-io\"],\"_rt-async-task\":[\"async-task\"],\"_rt-smol\":[\"smol\",\"_rt-async-io\",\"_rt-async-task\"],\"_rt-tokio\":[\"tokio\",\"tokio-stream\"],\"_tls-native-tls\":[\"native-tls\"],\"_tls-none\":[],\"_tls-rustls\":[\"rustls\"],\"_tls-rustls-aws-lc-rs\":[\"_tls-rustls\",\"rustls/aws-lc-rs\",\"webpki-roots\"],\"_tls-rustls-ring-native-roots\":[\"_tls-rustls\",\"rustls/ring\",\"rustls-native-certs\"],\"_tls-rustls-ring-webpki\":[\"_tls-rustls\",\"rustls/ring\",\"webpki-roots\"],\"_unstable-doc\":[\"sqlx-toml\"],\"any\":[],\"default\":[],\"json\":[\"serde\",\"serde_json\"],\"migrate\":[\"sha2\",\"crc\"],\"offline\":[\"serde\",\"either/serde\"],\"sqlx-toml\":[\"serde\",\"toml/parse\"]},\"strip_prefix\":\"sqlx-core\"}",
       "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c_sqlx-sqlite": "{\"dependencies\":[{\"name\":\"atoi\",\"req\":\"2.0\"},{\"default_features\":false,\"features\":[\"std\",\"clock\"],\"name\":\"chrono\",\"optional\":true,\"req\":\"0.4.34\"},{\"default_features\":false,\"features\":[\"async\"],\"name\":\"flume\",\"optional\":false,\"req\":\"0.12.0\"},{\"name\":\"form_urlencoded\",\"req\":\"1.2.2\"},{\"default_features\":false,\"features\":[\"sink\",\"alloc\",\"std\"],\"name\":\"futures-channel\",\"optional\":false,\"req\":\"0.3.32\"},{\"default_features\":false,\"features\":[],\"name\":\"futures-core\",\"optional\":false,\"req\":\"0.3.32\"},{\"default_features\":true,\"features\":[],\"name\":\"futures-executor\",\"optional\":false,\"req\":\"0.3.32\"},{\"name\":\"futures-intrusive\",\"req\":\"0.5.0\"},{\"default_features\":false,\"features\":[\"alloc\",\"sink\"],\"name\":\"futures-util\",\"optional\":false,\"req\":\"0.3.32\"},{\"default_features\":false,\"features\":[\"pkg-config\",\"vcpkg\"],\"name\":\"libsqlite3-sys\",\"optional\":false,\"req\":\">=0.30.1, <0.40.0\"},{\"name\":\"log\",\"req\":\"0.4.18\"},{\"name\":\"percent-encoding\",\"req\":\"2.3.0\"},{\"default_features\":true,\"features\":[],\"name\":\"regex\",\"optional\":true,\"req\":\"1.6.0\"},{\"default_features\":true,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"1.0.219\"},{\"default_features\":true,\"features\":[],\"name\":\"sqlx-core\",\"optional\":false,\"req\":\"=0.9.0\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"thiserror\",\"optional\":false,\"req\":\"2.0.18\"},{\"default_features\":true,\"features\":[\"formatting\",\"parsing\",\"macros\"],\"name\":\"time\",\"optional\":true,\"req\":\"0.3.48\"},{\"default_features\":true,\"features\":[\"log\"],\"name\":\"tracing\",\"optional\":false,\"req\":\"0.1.37\"},{\"default_features\":true,\"features\":[],\"name\":\"url\",\"optional\":false,\"req\":\"2.2.2\"},{\"name\":\"uuid\",\"optional\":true,\"req\":\"1.12.1\"}],\"features\":{\"_unstable-all-sqlite-features\":[\"deserialize\",\"load-extension\",\"preupdate-hook\",\"unlock-notify\"],\"_unstable-all-types\":[\"json\",\"chrono\",\"time\",\"uuid\"],\"_unstable-docs\":[\"bundled\",\"any\",\"_unstable-all-types\",\"_unstable-all-sqlite-features\"],\"any\":[\"sqlx-core/any\"],\"bigdecimal\":[],\"bundled\":[\"libsqlite3-sys/bundled\"],\"chrono\":[\"dep:chrono\",\"sqlx-core/chrono\"],\"deserialize\":[],\"json\":[\"sqlx-core/json\",\"serde\"],\"load-extension\":[],\"migrate\":[\"sqlx-core/migrate\"],\"offline\":[\"sqlx-core/offline\",\"serde\"],\"preupdate-hook\":[\"libsqlite3-sys/preupdate_hook\"],\"regexp\":[\"dep:regex\"],\"rust_decimal\":[],\"sqlx-toml\":[\"sqlx-core/sqlx-toml\"],\"time\":[\"dep:time\",\"sqlx-core/time\"],\"unbundled\":[\"libsqlite3-sys/buildtime_bindgen\"],\"unlock-notify\":[\"libsqlite3-sys/unlock_notify\"],\"uuid\":[\"dep:uuid\",\"sqlx-core/uuid\"]},\"strip_prefix\":\"sqlx-sqlite\"}",
       "git2_0.21.0": "{\"dependencies\":[{\"name\":\"bitflags\",\"req\":\"^2.1.0\"},{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"clap\",\"req\":\"^4.4.13\"},{\"name\":\"libc\",\"req\":\"^0.2\"},{\"name\":\"libgit2-sys\",\"req\":\"^0.18.4\"},{\"name\":\"log\",\"req\":\"^0.4.8\"},{\"name\":\"openssl-probe\",\"optional\":true,\"req\":\"^0.1\",\"target\":\"cfg(all(unix, not(target_os = \\\"macos\\\")))\"},{\"name\":\"openssl-sys\",\"optional\":true,\"req\":\"^0.9.45\",\"target\":\"cfg(all(unix, not(target_os = \\\"macos\\\")))\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.1.0\"},{\"features\":[\"formatting\"],\"kind\":\"dev\",\"name\":\"time\",\"req\":\"^0.3.47\"},{\"name\":\"url\",\"optional\":true,\"req\":\"^2.5.4\"},{\"kind\":\"dev\",\"name\":\"url\",\"req\":\"^2.5.4\"}],\"features\":{\"cred\":[\"dep:url\"],\"default\":[],\"https\":[\"libgit2-sys/https\",\"openssl-sys\",\"openssl-probe\",\"cred\"],\"ssh\":[\"libgit2-sys/ssh\",\"cred\"],\"unstable\":[],\"unstable-sha256\":[\"libgit2-sys/unstable-sha256\"],\"vendored-libgit2\":[\"libgit2-sys/vendored\"],\"vendored-openssl\":[\"openssl-sys/vendored\",\"libgit2-sys/vendored-openssl\"],\"zlib-ng-compat\":[\"libgit2-sys/zlib-ng-compat\"]}}",
+      "git_archive_integrity:https://codeload.github.com/dzbarsky/rules_rust/tar.gz/b56cbaa8465e74127f1ea216f813cd377295ad81": "sha256-3b30DbjfaF32fDJg3+Wc9/+ksZOpMk4Qs1m76JgdueA=",
+      "git_archive_integrity:https://codeload.github.com/helix-editor/nucleo/tar.gz/4253de9faabb4e5c6d81d946a5e35a90f87347ee": "sha256-0WdqwzqCxZA//t5oznPJ2SRmaqihArtkmo+5JqemHOE=",
+      "git_archive_integrity:https://codeload.github.com/hyperium/h3/tar.gz/e07e69412876f7e26f026bd75a48b2704d8c8283": "sha256-O52KnRCEH+J/uGyXoGvs4UEfywrPrcDKhXtjZdTl0po=",
+      "git_archive_integrity:https://codeload.github.com/microsoft/mxc/tar.gz/b21120168d70befe12356411423266bfef168446": "sha256-y1jhNgvGsVfkERZ48U4StdlXS9UIoCzKUUphwvu6+m8=",
+      "git_archive_integrity:https://codeload.github.com/modelcontextprotocol/rust-sdk/tar.gz/98a54789b80110ad210495c4ad845c89e1980471": "sha256-u1NcSLjm/O48vcV54D6qYiUrp0n/IW7+GZ2DcSLJ/lI=",
+      "git_archive_integrity:https://codeload.github.com/openai-oss-forks/crossterm/tar.gz/ed1cdab335221515706178d68495bba2aed1924f": "sha256-NTDNN30IByL2McZWbl7bSESri+j0sYXWvkoru6VZFTE=",
+      "git_archive_integrity:https://codeload.github.com/openai-oss-forks/rusty_v8/tar.gz/90a65f887a0c0f048f3784afbcb320b373c8a2e0": "sha256-sLGI0fHYUavXgzeBiiihXoTxQ7CCzpZpdukgZhdoQ3M=",
+      "git_archive_integrity:https://codeload.github.com/openai-oss-forks/tokio-tungstenite/tar.gz/02cb49fa827411e9279e3688d19ab9e82661b0e8": "sha256-NQVRikscRSkjjX21eSPXIPUO986793dUN+K0XkB4BTI=",
+      "git_archive_integrity:https://codeload.github.com/openai-oss-forks/tungstenite-rs/tar.gz/db4be399bc1b8b5de2edb46c7187834edabf7e30": "sha256-M13cpAl8xKXQ5fXakPMxlfIpXKOYBMi/cBoBA6xvhFo=",
+      "git_archive_integrity:https://codeload.github.com/rust-lang/rust-clippy/tar.gz/21baba9c10c5d179915cae82e6247bc2337872fb": "sha256-hoAjPoWso23OSqakAcd6ghJRUEZp1CiOnHQPZpRNFS4=",
+      "git_archive_integrity:https://codeload.github.com/transact-rs/sqlx/tar.gz/10462fa4414c6c7f1ed1d39bb31678e3b726878c": "sha256-jFe976E+ztpfve0rVarAyR59YIlWuCD4HS7GstpgFN4=",
       "gix-actor_0.44.0": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"std\",\"unicode\"],\"name\":\"bstr\",\"req\":\"^1.12.0\"},{\"name\":\"document-features\",\"optional\":true,\"req\":\"^0.2.0\"},{\"name\":\"gix-date\",\"req\":\"^0.18.0\"},{\"features\":[\"bstr\"],\"name\":\"gix-error\",\"req\":\"^0.5.0\"},{\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.46.3\"},{\"kind\":\"dev\",\"name\":\"pretty_assertions\",\"req\":\"^1.0.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.114\"}],\"features\":{\"serde\":[\"dep:serde\",\"bstr/serde\",\"gix-date/serde\"]}}",
       "gix-attributes_0.37.0": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"std\",\"unicode\"],\"name\":\"bstr\",\"req\":\"^1.12.0\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.8.2\"},{\"name\":\"document-features\",\"optional\":true,\"req\":\"^0.2.1\"},{\"features\":[\"bstr\"],\"name\":\"gix-error\",\"req\":\"^0.5.0\"},{\"name\":\"gix-glob\",\"req\":\"^0.29.0\"},{\"name\":\"gix-parallel\",\"req\":\"^0.50.0\"},{\"name\":\"gix-path\",\"req\":\"^0.14.0\"},{\"name\":\"gix-quote\",\"req\":\"^0.10.0\"},{\"name\":\"gix-trace\",\"req\":\"^0.3.0\"},{\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.46.3\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.114\"},{\"name\":\"smallvec\",\"req\":\"^1.15.1\"},{\"name\":\"unicode-bom\",\"req\":\"^2.0.3\"}],\"features\":{\"serde\":[\"dep:serde\",\"bstr/serde\",\"gix-glob/serde\"]}}",
       "gix-chunk_0.10.0": "{\"dependencies\":[{\"features\":[\"bstr\"],\"name\":\"gix-error\",\"req\":\"^0.5.0\"}],\"features\":{}}",
@@ -1576,6 +1577,7 @@
       "jobserver_0.1.34": "{\"dependencies\":[{\"features\":[\"std\"],\"name\":\"getrandom\",\"req\":\"^0.3.2\",\"target\":\"cfg(windows)\"},{\"name\":\"libc\",\"req\":\"^0.2.171\",\"target\":\"cfg(unix)\"},{\"features\":[\"fs\"],\"kind\":\"dev\",\"name\":\"nix\",\"req\":\"^0.28.0\",\"target\":\"cfg(unix)\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.10.1\"}],\"features\":{}}",
       "js-sys_0.3.82": "{\"dependencies\":[{\"default_features\":false,\"name\":\"once_cell\",\"req\":\"^1.12\"},{\"default_features\":false,\"name\":\"wasm-bindgen\",\"req\":\"=0.2.105\"}],\"features\":{\"default\":[\"std\"],\"std\":[\"wasm-bindgen/std\"]}}",
       "js-sys_0.3.85": "{\"dependencies\":[{\"default_features\":false,\"name\":\"once_cell\",\"req\":\"^1.12\"},{\"default_features\":false,\"name\":\"wasm-bindgen\",\"req\":\"=0.2.108\"}],\"features\":{\"default\":[\"std\"],\"std\":[\"wasm-bindgen/std\"]}}",
+      "jsonc-parser_0.26.2": "{\"dependencies\":[{\"name\":\"indexmap\",\"optional\":true,\"req\":\"^2.2.6\"},{\"kind\":\"dev\",\"name\":\"pretty_assertions\",\"req\":\"^1.0.0\"},{\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0\"},{\"name\":\"unicode-width\",\"optional\":true,\"req\":\"^0.2.0\"}],\"features\":{\"cst\":[],\"error_unicode_width\":[\"unicode-width\"],\"preserve_order\":[\"indexmap\",\"serde_json/preserve_order\"],\"serde\":[\"serde_json\"]}}",
       "jsonptr_0.7.1": "{\"dependencies\":[{\"features\":[\"fancy\"],\"name\":\"miette\",\"optional\":true,\"req\":\"^7.4.0\"},{\"kind\":\"dev\",\"name\":\"quickcheck\",\"req\":\"^1.0.3\"},{\"kind\":\"dev\",\"name\":\"quickcheck_macros\",\"req\":\"^1.0.0\"},{\"features\":[\"alloc\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.203\"},{\"features\":[\"alloc\"],\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0.119\"},{\"name\":\"syn\",\"optional\":true,\"req\":\"^1.0.109\",\"target\":\"cfg(any())\"},{\"name\":\"toml\",\"optional\":true,\"req\":\"^0.8\"}],\"features\":{\"assign\":[],\"default\":[\"std\",\"serde\",\"json\",\"resolve\",\"assign\",\"delete\"],\"delete\":[\"resolve\"],\"json\":[\"dep:serde_json\",\"serde\"],\"miette\":[\"dep:miette\",\"std\"],\"resolve\":[],\"std\":[\"serde/std\",\"serde_json?/std\"],\"toml\":[\"dep:toml\",\"serde\",\"std\"]}}",
       "jsonwebtoken_9.3.1": "{\"dependencies\":[{\"name\":\"base64\",\"req\":\"^0.22\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.4\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", not(any(target_os = \\\"emscripten\\\", target_os = \\\"wasi\\\"))))\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.4\",\"target\":\"cfg(not(all(target_arch = \\\"wasm32\\\", not(any(target_os = \\\"emscripten\\\", target_os = \\\"wasi\\\")))))\"},{\"name\":\"js-sys\",\"req\":\"^0.3\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"name\":\"pem\",\"optional\":true,\"req\":\"^3\"},{\"features\":[\"std\"],\"name\":\"ring\",\"req\":\"^0.17.4\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"features\":[\"std\",\"wasm32_unknown_unknown_js\"],\"name\":\"ring\",\"req\":\"^0.17.4\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"features\":[\"derive\"],\"name\":\"serde\",\"req\":\"^1.0\"},{\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"name\":\"simple_asn1\",\"optional\":true,\"req\":\"^0.6\"},{\"features\":[\"wasm-bindgen\"],\"kind\":\"dev\",\"name\":\"time\",\"req\":\"^0.3\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", not(any(target_os = \\\"emscripten\\\", target_os = \\\"wasi\\\"))))\"},{\"kind\":\"dev\",\"name\":\"time\",\"req\":\"^0.3\",\"target\":\"cfg(not(all(target_arch = \\\"wasm32\\\", not(any(target_os = \\\"emscripten\\\", target_os = \\\"wasi\\\")))))\"},{\"kind\":\"dev\",\"name\":\"wasm-bindgen-test\",\"req\":\"^0.3.1\"}],\"features\":{\"default\":[\"use_pem\"],\"use_pem\":[\"pem\",\"simple_asn1\"]}}",
       "kasuari_0.4.12": "{\"dependencies\":[{\"name\":\"document-features\",\"optional\":true,\"req\":\"^0.2\"},{\"name\":\"hashbrown\",\"req\":\"^0.16\"},{\"default_features\":false,\"features\":[\"require-cas\"],\"name\":\"portable-atomic\",\"optional\":true,\"req\":\"^1.13\"},{\"features\":[\"alloc\"],\"name\":\"portable-atomic-util\",\"optional\":true,\"req\":\"^0.2.5\"},{\"kind\":\"dev\",\"name\":\"rstest\",\"req\":\"^0.26\"},{\"default_features\":false,\"name\":\"thiserror\",\"req\":\"^2.0\"}],\"features\":{\"default\":[\"std\"],\"document-features\":[\"dep:document-features\"],\"portable-atomic\":[\"dep:portable-atomic\",\"dep:portable-atomic-util\"],\"std\":[\"thiserror/std\",\"portable-atomic?/std\"]}}",
@@ -2481,6 +2483,7 @@
       "rust-std-1.95.0-powerpc64-unknown-linux-gnu.tar.xz": "cc7fb9aa289ff1756502ae16a05e2885289165f01ed94a7c2db6576b3dae74a6",
       "rust-std-1.95.0-powerpc64le-unknown-linux-gnu.tar.xz": "2370d9266051a0b23346d42e43a00f91b2daff22a963fb03e28ae50cb0b76c50",
       "rust-std-1.95.0-powerpc64le-unknown-linux-musl.tar.xz": "0362ba4ecfe0bb508f0d2b064c6fbbfe72604d5ae1989d6a8a7b4fe5ff1889f1",
+      "rust-std-1.95.0-riscv32imac-unknown-none-elf.tar.xz": "09d568f3f445670917ee9aeb3a86374dae760da8a92d4bfecde88af7fe0bd6ad",
       "rust-std-1.95.0-riscv32imc-unknown-none-elf.tar.xz": "04befebf3b15372dacb7e6c0fcdab842c17a63ea58bf2f4cdccd7182ae9195c6",
       "rust-std-1.95.0-riscv64gc-unknown-linux-gnu.tar.xz": "50fe7869e166bb4c990a0e1664366b1ffdbe669664b7663cd03c079bd0efdcac",
       "rust-std-1.95.0-riscv64gc-unknown-linux-musl.tar.xz": "e01bdbf5d6fa3e529671d49e87ba81dc9612101144f3ee5a0e1de3c48f27b47c",
diff --git a/bazel/rules/runtime_package.bzl b/bazel/rules/runtime_package.bzl
index 073c0b4fad..cf44dd2cce 100644
--- a/bazel/rules/runtime_package.bzl
+++ b/bazel/rules/runtime_package.bzl
@@ -16,7 +16,6 @@ _PROFILE_INPUTS = [
     "//command_line_option:host_action_env",
     "//command_line_option:macos_minimum_os",
     "//command_line_option:host_platform",
-    "//command_line_option:extra_toolchains",
     _RUSTC_FLAGS,
     _EXEC_RUSTC_FLAGS,
 ]
@@ -61,12 +60,8 @@ def _release_profile_impl(settings, attr):
         # Compatibility with the Cargo musl release: aws-lc jitter can hang.
         profile["//command_line_option:copt"] += ["-DDISABLE_CPU_JITTER_ENTROPY"]
     elif attr.platform_os == "windows" and "@platforms//os:windows" in HOST_CONSTRAINTS:
-        # Native MSVC supplies the SDK and host tools for both architectures.
+        # Build tools run natively with the registered LLVM MSVC toolchain.
         profile["//command_line_option:host_platform"] = "//:local_windows_msvc"
-        profile["//command_line_option:extra_toolchains"] += [
-            "@local_config_cc//:cc-toolchain-x64_windows",
-            "@local_config_cc//:cc-toolchain-arm64_windows",
-        ]
     if attr.linux_x86_64_musl:
         # Match the Cargo release linker for x86-64 static PIEs.
         profile[_RUSTC_FLAGS] += [
diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index 7d3b08af27..6b9ad62907 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -2315,6 +2315,7 @@ dependencies = [
  "codex-core",
  "codex-otel",
  "codex-protocol",
+ "codex-utils-cargo-bin",
  "codex-utils-cli",
  "pretty_assertions",
  "serde",
diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index 5b2703f573..623f00cf16 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -594,8 +594,8 @@ zstd = "0.13"
 wiremock = "0.6"
 zeroize = "1.8.2"
 
-[workspace.lints]
-rust = {}
+[workspace.lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(codex_bazel)'] }
 
 [workspace.lints.clippy]
 await_holding_invalid_type = "deny"
diff --git a/codex-rs/app-server-test-client/BUILD.bazel b/codex-rs/app-server-test-client/BUILD.bazel
index 3a1686a04e..8ee6f3e524 100644
--- a/codex-rs/app-server-test-client/BUILD.bazel
+++ b/codex-rs/app-server-test-client/BUILD.bazel
@@ -3,4 +3,5 @@ load("//:defs.bzl", "codex_rust_crate")
 codex_rust_crate(
     name = "app-server-test-client",
     crate_name = "codex_app_server_test_client",
+    lib_data_extra = ["scripts/live_elicitation_hold.sh"],
 )
diff --git a/codex-rs/app-server-test-client/Cargo.toml b/codex-rs/app-server-test-client/Cargo.toml
index 901afb70d0..6017fa0ecd 100644
--- a/codex-rs/app-server-test-client/Cargo.toml
+++ b/codex-rs/app-server-test-client/Cargo.toml
@@ -14,6 +14,7 @@ codex-app-server-protocol = { workspace = true }
 codex-core = { workspace = true }
 codex-otel = { workspace = true }
 codex-protocol = { workspace = true }
+codex-utils-cargo-bin = { workspace = true }
 codex-utils-cli = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
diff --git a/codex-rs/app-server-test-client/src/lib.rs b/codex-rs/app-server-test-client/src/lib.rs
index 6c6cbc2413..c57f9758fe 100644
--- a/codex-rs/app-server-test-client/src/lib.rs
+++ b/codex-rs/app-server-test-client/src/lib.rs
@@ -1272,11 +1272,10 @@ fn live_elicitation_timeout_pause(
         (None, None) => "ws://127.0.0.1:4222".to_string(),
     };
 
-    let script_path = script.unwrap_or_else(|| {
-        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-            .join("scripts")
-            .join("live_elicitation_hold.sh")
-    });
+    let script_path = match script {
+        Some(script) => script,
+        None => codex_utils_cargo_bin::find_resource!("scripts/live_elicitation_hold.sh")?,
+    };
     if !script_path.is_file() {
         bail!("helper script not found: {}", script_path.display());
     }
diff --git a/codex-rs/config-schema/src/main.rs b/codex-rs/config-schema/src/main.rs
index ef5608f700..6a91ebb9be 100644
--- a/codex-rs/config-schema/src/main.rs
+++ b/codex-rs/config-schema/src/main.rs
@@ -14,9 +14,30 @@ struct Args {
 
 fn main() -> Result<()> {
     let args = Args::parse();
-    let out_path = args.out.unwrap_or_else(|| {
-        PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../core/config.schema.json")
-    });
+    let out_path = match args.out {
+        Some(path) => path,
+        None => default_out_path()?,
+    };
     codex_config::schema::write_config_schema(&out_path)?;
     Ok(())
 }
+
+fn default_out_path() -> Result<PathBuf> {
+    // Cargo supplies this when running the tool, including from outside the checkout.
+    if let Some(manifest_dir) = std::env::var_os("CARGO_MANIFEST_DIR") {
+        return Ok(PathBuf::from(manifest_dir).join("../core/config.schema.json"));
+    }
+
+    let cwd = std::env::current_dir()?;
+    for directory in cwd.ancestors() {
+        for workspace in [directory.to_path_buf(), directory.join("codex-rs")] {
+            if workspace.join("config-schema/Cargo.toml").is_file()
+                && workspace.join("core/Cargo.toml").is_file()
+            {
+                return Ok(workspace.join("core/config.schema.json"));
+            }
+        }
+    }
+
+    anyhow::bail!("could not locate the Codex checkout; specify the schema output with --out")
+}
diff --git a/codex-rs/hooks/src/bin/write_hooks_schema_fixtures.rs b/codex-rs/hooks/src/bin/write_hooks_schema_fixtures.rs
index 303b561bf3..ed986ecbae 100644
--- a/codex-rs/hooks/src/bin/write_hooks_schema_fixtures.rs
+++ b/codex-rs/hooks/src/bin/write_hooks_schema_fixtures.rs
@@ -1,9 +1,29 @@
 use std::path::PathBuf;
 
 fn main() -> anyhow::Result<()> {
-    let schema_root = std::env::args_os()
-        .nth(1)
-        .map(PathBuf::from)
-        .unwrap_or_else(|| PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("schema"));
+    let schema_root = match std::env::args_os().nth(1) {
+        Some(path) => PathBuf::from(path),
+        None => default_schema_root()?,
+    };
     codex_hooks::write_schema_fixtures(&schema_root)
 }
+
+fn default_schema_root() -> anyhow::Result<PathBuf> {
+    // Preserve Cargo's default without retaining its compile-time source path.
+    if let Some(manifest_dir) = std::env::var_os("CARGO_MANIFEST_DIR") {
+        return Ok(PathBuf::from(manifest_dir).join("schema"));
+    }
+
+    let cwd = std::env::current_dir()?;
+    for directory in cwd.ancestors() {
+        for workspace in [directory.to_path_buf(), directory.join("codex-rs")] {
+            if workspace.join("hooks/Cargo.toml").is_file()
+                && workspace.join("core/Cargo.toml").is_file()
+            {
+                return Ok(workspace.join("hooks/schema"));
+            }
+        }
+    }
+
+    anyhow::bail!("could not locate the Codex checkout; specify the schema output directory")
+}
diff --git a/codex-rs/utils/cargo-bin/BUILD.bazel b/codex-rs/utils/cargo-bin/BUILD.bazel
index e4a96f5b6d..6e26b07a68 100644
--- a/codex-rs/utils/cargo-bin/BUILD.bazel
+++ b/codex-rs/utils/cargo-bin/BUILD.bazel
@@ -13,5 +13,6 @@ codex_rust_crate(
     rustc_env = {
         "CODEX_REPO_ROOT_MARKER": "$(rlocationpath :repo_root.marker)",
     },
+    rustc_flags_extra = ["--cfg=codex_bazel"],
     test_data_extra = ["repo_root.marker"],
 )
diff --git a/codex-rs/utils/cargo-bin/README.md b/codex-rs/utils/cargo-bin/README.md
index c1f006cafc..98aaad0100 100644
--- a/codex-rs/utils/cargo-bin/README.md
+++ b/codex-rs/utils/cargo-bin/README.md
@@ -12,9 +12,14 @@ Function behavior:
   Bazel) and resolves them via the runfiles manifest when `RUNFILES_MANIFEST_FILE`
   is present. When not under runfiles, it only accepts absolute paths from
   `CARGO_BIN_EXE_*` and returns an error otherwise.
-- `find_resource!`: used by tests to locate fixtures. It chooses the Bazel
-  runfiles resolution path when `RUNFILES_MANIFEST_FILE` is set, otherwise it
-  falls back to a `CARGO_MANIFEST_DIR`-relative path for Cargo runs.
+- `find_resource!`: used by tests to locate fixtures relative to the calling
+  package. Bazel compiles this helper with `codex_bazel`, selecting runfiles
+  lookup without embedding the build worker's Cargo source directory. Missing
+  runfiles produce an error. Cargo builds retain the `CARGO_MANIFEST_DIR`-relative
+  fallback when runfiles are unavailable.
+- `resolve_cargo_runfile`: retains source-directory lookup for Cargo builds;
+  Bazel builds return an unsupported-operation error. This also prevents
+  `repo_root` from falling back to a build worker's source directory.
 
 Background:
 
diff --git a/codex-rs/utils/cargo-bin/src/lib.rs b/codex-rs/utils/cargo-bin/src/lib.rs
index 6ef7080cbc..32a2329838 100644
--- a/codex-rs/utils/cargo-bin/src/lib.rs
+++ b/codex-rs/utils/cargo-bin/src/lib.rs
@@ -125,6 +125,19 @@ fn resolve_bin_from_env(key: &str, value: OsString) -> Result<PathBuf, CargoBinE
 ///
 /// This is expected to be used exclusively in test code because Codex CLI is a
 /// standalone binary with no packaged resources.
+#[cfg(codex_bazel)]
+#[macro_export]
+macro_rules! find_resource {
+    ($resource:expr) => {{
+        // Capture the caller's package, not the package of this helper crate.
+        $crate::resolve_bazel_runfile(
+            option_env!("BAZEL_PACKAGE"),
+            std::path::Path::new(&$resource),
+        )
+    }};
+}
+
+#[cfg(not(codex_bazel))]
 #[macro_export]
 macro_rules! find_resource {
     ($resource:expr) => {{
@@ -170,11 +183,20 @@ pub fn resolve_bazel_runfile(
     ))
 }
 
+#[cfg(not(codex_bazel))]
 pub fn resolve_cargo_runfile(resource: &Path) -> std::io::Result<PathBuf> {
     let manifest_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
     Ok(manifest_dir.join(resource))
 }
 
+#[cfg(codex_bazel)]
+pub fn resolve_cargo_runfile(_resource: &Path) -> std::io::Result<PathBuf> {
+    Err(io::Error::new(
+        io::ErrorKind::Unsupported,
+        "Cargo source-directory lookup is unavailable in Bazel builds; use runfiles",
+    ))
+}
+
 pub fn repo_root() -> io::Result<PathBuf> {
     let marker = if runfiles_available() {
         let runfiles = runfiles::Runfiles::create()
diff --git a/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs b/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs
index be2d1bf07c..f3c43cee8d 100644
--- a/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs
+++ b/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs
@@ -77,10 +77,9 @@ fn sandbox_cwd() -> PathBuf {
         return PathBuf::from(workspace_root);
     }
 
-    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-        .parent()
-        .expect("repo root")
-        .to_path_buf()
+    codex_utils_cargo_bin::repo_root()
+        .expect("resolve repository root")
+        .join("codex-rs")
 }
 
 fn sandbox_home(name: &str) -> TempDir {
@@ -776,6 +775,10 @@ fn legacy_workspace_write_delete_is_limited_to_writable_roots() {
         .expect("write delete script");
 
         let env_map = HashMap::from([
+            (
+                "SystemRoot".to_string(),
+                std::env::var("SystemRoot").expect("Windows SystemRoot"),
+            ),
             ("TEMP".to_string(), temp_root.to_string_lossy().into_owned()),
             ("TMP".to_string(), tmp_root.to_string_lossy().into_owned()),
             (
diff --git a/defs.bzl b/defs.bzl
index fbceacee8f..2b37b1aab4 100644
--- a/defs.bzl
+++ b/defs.bzl
@@ -322,6 +322,10 @@ def codex_rust_crate(
         "CARGO_PKG_NAME": package_data["package_name"],
     } | rustc_env
 
+    # Insta also reads this during macro expansion. Match the test launcher's
+    # workspace-relative root instead of embedding CARGO_MANIFEST_DIR.
+    test_rustc_env = rustc_env | {"INSTA_WORKSPACE_ROOT": "."}
+
     manifest_relpath = native.package_name()
     if manifest_relpath.startswith("codex-rs/"):
         manifest_relpath = manifest_relpath[len("codex-rs/"):]
@@ -389,7 +393,7 @@ def codex_rust_crate(
                 "--remap-path-prefix=../codex-rs=",
                 "--remap-path-prefix=codex-rs=",
             ],
-            rustc_env = rustc_env,
+            rustc_env = test_rustc_env,
             data = test_data_extra + [binary for binary in extra_binaries if binary not in test_data_extra],
             tags = test_tags + ["manual"],
             version = crate_version,
@@ -475,7 +479,7 @@ def codex_rust_crate(
                 "--remap-path-prefix=../codex-rs=",
                 "--remap-path-prefix=codex-rs=",
             ],
-            rustc_env = rustc_env,
+            rustc_env = test_rustc_env,
             data = test_data_extra,
             tags = test_tags + ["manual"],
             version = crate_version,
@@ -612,7 +616,7 @@ def codex_rust_crate(
                     "--remap-path-prefix=../codex-rs=",
                     "--remap-path-prefix=codex-rs=",
                 ],
-                rustc_env = rustc_env,
+                rustc_env = test_rustc_env,
                 target_compatible_with = WINDOWS_GNULLVM_INCOMPATIBLE,
                 tags = test_tags + ["manual"],
                 version = crate_version,
@@ -653,7 +657,7 @@ def codex_rust_crate(
                     "--remap-path-prefix=../codex-rs=",
                     "--remap-path-prefix=codex-rs=",
                 ],
-                rustc_env = rustc_env,
+                rustc_env = test_rustc_env,
                 env = integration_test_cargo_env,
                 target_compatible_with = WINDOWS_GNULLVM_INCOMPATIBLE,
                 tags = test_tags,
@@ -726,7 +730,7 @@ def codex_rust_crate(
                 "--remap-path-prefix=../codex-rs=",
                 "--remap-path-prefix=codex-rs=",
             ],
-            rustc_env = rustc_env,
+            rustc_env = test_rustc_env,
             env = integration_test_cargo_env,
             target_compatible_with = WINDOWS_GNULLVM_ONLY,
             tags = test_tags + ["manual"],
diff --git a/patches/BUILD.bazel b/patches/BUILD.bazel
index 1fe58257fc..7d6983a658 100644
--- a/patches/BUILD.bazel
+++ b/patches/BUILD.bazel
@@ -1,27 +1,23 @@
 exports_files([
     "opusic_sys_install_headers.patch",
-    "rules_cc_windows_native_llvm.patch",
+    "protobuf_windows_arm64_seh.patch",
+    "opusic-sys_presume_neon.patch",
+    "llvm_mingw_import_warnings.patch",
+    "rules_rust_declared_msvc_linker.patch",
+    "rules_rs_bindgen_v0_0_4.patch",
     "abseil_windows_gnullvm_thread_identity.patch",
     "bzip2_windows_stack_args.patch",
-    "llvm_rusty_v8_custom_libcxx.patch",
-    "llvm_windows_arm64_powl.patch",
-    "llvm_windows_mingw_compat.patch",
     "mxc-sdk_utf8_resources.patch",
-    "rules_rust_build_script_tools_transition.patch",
     "rules_rust_compiler_thp.patch",
     "rules_rust_process_wrapper_param_file.patch",
     "rules_rust_release_build_script_profile.patch",
     "rules_rust_windows_execroot_separators.patch",
-    "rules_rust_windows_msvc_direct_link_args.patch",
-    "rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
     "rules_foreign_cc_make_cppflags.patch",
     "rules_foreign_cc_make_xcompile.patch",
     "rules_foreign_cc_make_msvc_stdint.patch",
     "rules_rs_build_script_deps_annotation.patch",
     "rules_rs_rust_debug_modes.patch",
-    "rules_rs_windows_msvc_linker.patch",
     "rules_rs_workspace_package_version.patch",
-    "rules_rs_zlib_snapshot_urls.patch",
     "rusty_v8_prebuilt_out_dir.patch",
     "ring_windows_msvc_include_dirs.patch",
     "tikv-jemalloc-sys_make_env.patch",
diff --git a/patches/llvm_mingw_import_warnings.patch b/patches/llvm_mingw_import_warnings.patch
new file mode 100644
index 0000000000..e5fe3b1c92
--- /dev/null
+++ b/patches/llvm_mingw_import_warnings.patch
@@ -0,0 +1,12 @@
+diff --git a/runtimes/mingw/import_libs.bzl b/runtimes/mingw/import_libs.bzl
+--- a/runtimes/mingw/import_libs.bzl
++++ b/runtimes/mingw/import_libs.bzl
+@@ -30,6 +30,8 @@
+     # ucrtbase-common.def.in:1800:28: warning: missing terminating ' character [-Winvalid-pp-token]
+     # 1800 | F_LD64(_o_remainderl) ; Can't use long double functions from the CRT on x86
+     args.add("-Wno-invalid-pp-token")
++    # MinGW 14 func.def.in uses #ifndef F_X86_NATIVE(x).
++    args.add("-Wno-extra-tokens")
+ 
+     args.add("-o", ctx.outputs.out)
+     args.add(undecorated)
diff --git a/patches/llvm_rusty_v8_custom_libcxx.patch b/patches/llvm_rusty_v8_custom_libcxx.patch
deleted file mode 100644
index dc5f4e652d..0000000000
--- a/patches/llvm_rusty_v8_custom_libcxx.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
-index fa00156236..c9e4348172 100644
---- a/toolchain/BUILD.bazel
-+++ b/toolchain/BUILD.bazel
-@@ -1,5 +1,6 @@
- load("@bazel_lib//:bzl_library.bzl", "bzl_library")
-+load("@bazel_skylib//lib:selects.bzl", "selects")
- load("@bazel_skylib//rules:common_settings.bzl", "string_flag", "string_setting")
- load("@rules_cc//cc/toolchains:actions.bzl", "cc_action_type_set")
- load("@rules_cc//cc/toolchains:artifacts.bzl", "cc_artifact_name_pattern")
- load("@rules_cc//cc/toolchains/impl:documented_api.bzl", "cc_args_list")
-@@ -64,6 +65,15 @@ config_setting(
-     visibility = ["//visibility:public"],
- )
--
-+
-+selects.config_setting_group(
-+    name = "runtimes_all_with_rusty_v8_custom_libcxx",
-+    match_all = [
-+        ":runtimes_all",
-+        "@@//third_party/v8:use_rusty_v8_custom_libcxx",
-+    ],
-+    visibility = ["//visibility:public"],
-+)
-+
- config_setting(
-     name = "runtimes_stage1",
-     flag_values = {
-@@ -270,11 +280,16 @@ cc_args_list(
- 
- # TODO(cerisier): extract those into proper semantic args list.
- # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
-+_DEFAULT_CXXSTDLIB_HEADER_ARGS = select({
-+    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [],
-+    "//conditions:default": [
-+        "//toolchain/args:cxxstdlib_headers_include_search_paths",
-+    ],
-+})
-+
- cc_args_list(
-     name = "linux_toolchain_args",
--    args = [
--        "//toolchain/args:cxxstdlib_headers_include_search_paths",
--    ] + select({
-+    args = _DEFAULT_CXXSTDLIB_HEADER_ARGS + select({
-         "//platforms/config:musl": [
-             "//toolchain/args/linux:kernel_headers_include_search_paths",
-             "//toolchain/args/linux:musl_libc_headers_include_search_paths",
-@@ -302,8 +317,7 @@ cc_args_list(
- # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
- cc_args_list(
-     name = "windows_toolchain_args",
--    args = [
--        "//toolchain/args:cxxstdlib_headers_include_search_paths",
-+    args = _DEFAULT_CXXSTDLIB_HEADER_ARGS + [
-         "//toolchain/args/windows:mingw_headers_include_search_paths",
-     ],
- )
-diff --git a/toolchain/llvm/llvm.bzl b/toolchain/llvm/llvm.bzl
-index d36d8b94bd..900aa908d5 100644
---- a/toolchain/llvm/llvm.bzl
-+++ b/toolchain/llvm/llvm.bzl
-@@ -297,18 +297,23 @@ def declare_llvm_targets(*, suffix = ""):
-         ],
-     )
- 
-+    default_cxxstdlib_target_headers = select({
-+        "@llvm//toolchain:runtimes_all_with_rusty_v8_custom_libcxx": [],
-+        "@llvm//toolchain:runtimes_stage1": [],
-+        "@llvm//toolchain:runtimes_stage1_hosted": [],
-+        "@llvm//toolchain:runtimes_none": [],
-+        "//conditions:default": [
-+            "@llvm//runtimes/cxxstdlib:headers_include_search_directory",
-+            "@llvm//runtimes/cxxstdlib:abi_headers_include_search_directory",
-+        ],
-+    })
-+
-     # This must match //toolchain:linux_toolchain_args
-     include_path(
-         name = "linux_target_headers",
-         srcs = [
-             ":builtin_resource_dir",
--        ] + select({
--            "@llvm//toolchain:runtimes_all": [
--                "@llvm//runtimes/cxxstdlib:headers_include_search_directory",
--                "@llvm//runtimes/cxxstdlib:abi_headers_include_search_directory",
--            ],
--            "//conditions:default": [],
--        }) + [
-+        ] + default_cxxstdlib_target_headers + [
-             "@kernel_headers//:kernel_headers_directory",
-             "@llvm//sanitizers:sanitizers_headers_include_search_directory",
-         ] + select({
-@@ -324,13 +329,7 @@ def declare_llvm_targets(*, suffix = ""):
-         name = "windows_target_headers",
-         srcs = [
-             ":builtin_resource_dir",
--        ] + select({
--            "@llvm//toolchain:runtimes_all": [
--                "@llvm//runtimes/cxxstdlib:headers_include_search_directory",
--                "@llvm//runtimes/cxxstdlib:abi_headers_include_search_directory",
--            ],
--            "//conditions:default": [],
--        }) + [
-+        ] + default_cxxstdlib_target_headers + [
-             "@mingw//:mingw_generated_headers_crt_directory",
-             "@mingw//:mingw_w64_headers_include_directory",
-             "@mingw//:mingw_w64_headers_crt_directory",
diff --git a/patches/llvm_windows_arm64_powl.patch b/patches/llvm_windows_arm64_powl.patch
deleted file mode 100644
index 0fd33c9766..0000000000
--- a/patches/llvm_windows_arm64_powl.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-# What: provide and link MinGW's ARM64 long-double `powl` compatibility shim.
-# Why: Windows ARM64 uses 64-bit long doubles, but LLVM's Bazel source list
-# omits the upstream `powl -> pow` implementation and its default link flags
-# omit the MinGW extension archive that owns the shim.
-
-diff --git a/runtimes/mingw/crt_sources.bzl b/runtimes/mingw/crt_sources.bzl
---- a/runtimes/mingw/crt_sources.bzl
-+++ b/runtimes/mingw/crt_sources.bzl
-@@ -420,4 +420,5 @@
- MINGWEX_ARM64_SRCS = [
-+    "math/arm-common/powl.c",
-     "math/sincos.c",
-     "math/sincosf.c",
-     "math/arm-common/sincosl.c",
-diff --git a/toolchain/args/windows/BUILD.bazel b/toolchain/args/windows/BUILD.bazel
---- a/toolchain/args/windows/BUILD.bazel
-+++ b/toolchain/args/windows/BUILD.bazel
-@@ -45,5 +45,6 @@ cc_args(
-     args = [
-         "-L{mingw_import_library_search_path}",
-         "-L{mingw_crt_library_search_path}",
--
-+        "-lmingwex",
-+
-         # Clang will respect the user's chosen CRT variant.
diff --git a/patches/llvm_windows_mingw_compat.patch b/patches/llvm_windows_mingw_compat.patch
deleted file mode 100644
index 66cf4e7b34..0000000000
--- a/patches/llvm_windows_mingw_compat.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-# What: provide MinGW compatibility archives required by Windows gnullvm links.
-# Why: clang and prebuilt MSVC archives can request these names even though the
-# hermetic MinGW runtime does not publish them by default.
-
-diff --git a/runtimes/mingw/BUILD.bazel b/runtimes/mingw/BUILD.bazel
---- a/runtimes/mingw/BUILD.bazel
-+++ b/runtimes/mingw/BUILD.bazel
-@@ -386,14 +386,42 @@ stub_library(
-     name = "stdc++",
- )
- 
-+# Clang may inject -lssp and -lssp_nonshared for windows-gnu links.
-+# Provide compatibility archives in the MinGW runtime search directory.
-+stub_library(
-+    name = "ssp",
-+)
-+
-+stub_library(
-+    name = "ssp_nonshared",
-+)
-+
-+# Prebuilt MSVC archives can carry /DEFAULTLIB:libcmt.lib and
-+# /DEFAULTLIB:oldnames.lib directives. Provide MinGW-compatible stand-ins so
-+# lld can satisfy the lookup under windows-gnullvm.
-+stub_library(
-+    name = "libcmt",
-+)
-+
-+copy_file(
-+    name = "oldnames",
-+    src = ":moldname",
-+    out = "liboldnames.a",
-+    visibility = ["//visibility:public"],
-+)
-+
- copy_to_directory(
-     name = "mingw_crt_library_search_directory",
-     srcs = [
-+        ":libcmt",
-         ":m",
-         ":mingw32",
-         ":mingwex",
-         ":moldname",
-+        ":oldnames",
-         ":pthread",
-+        ":ssp",
-+        ":ssp_nonshared",
-         ":stdc++",
-         ":uuid",
-         ":winpthread",
diff --git a/patches/opusic-sys_presume_neon.patch b/patches/opusic-sys_presume_neon.patch
new file mode 100644
index 0000000000..e4ddc7ac7d
--- /dev/null
+++ b/patches/opusic-sys_presume_neon.patch
@@ -0,0 +1,12 @@
+diff --git a/opus/CMakeLists.txt b/opus/CMakeLists.txt
+--- a/opus/CMakeLists.txt
++++ b/opus/CMakeLists.txt
+@@ -598,6 +598,8 @@
+     if(OPUS_PRESUME_NEON)
+       target_compile_definitions(opus
+                                  PRIVATE
++                                 OPUS_ARM_MAY_HAVE_NEON
++                                 OPUS_ARM_MAY_HAVE_NEON_INTR
+                                  OPUS_ARM_PRESUME_NEON
+                                  OPUS_ARM_PRESUME_NEON_INTR)
+     endif()
diff --git a/patches/protobuf_windows_arm64_seh.patch b/patches/protobuf_windows_arm64_seh.patch
new file mode 100644
index 0000000000..ac77d0ed9e
--- /dev/null
+++ b/patches/protobuf_windows_arm64_seh.patch
@@ -0,0 +1,11 @@
+--- a/upb/wire/encode.c
++++ b/upb/wire/encode.c
+@@ -187,7 +187,7 @@
+       "br %[addr]\n"
+       // Work around llvm/llvm-project#47432, where alignment directives inside
+       // functions crash the compiler when generating SEH info on windows.
+-      #ifndef __SEH__
++      #if !defined(__SEH__) && !defined(_WIN32)
+       ".p2align " UPB_BTI_SHIFT_IMM
+       #endif
+       "0:\n"
diff --git a/patches/ring_windows_msvc_include_dirs.patch b/patches/ring_windows_msvc_include_dirs.patch
index 7bb49cbc2c..95e8787abc 100644
--- a/patches/ring_windows_msvc_include_dirs.patch
+++ b/patches/ring_windows_msvc_include_dirs.patch
@@ -30,22 +30,20 @@ diff --git a/build.rs b/build.rs
      } else {
          generate_sources_and_preassemble(
              &out_dir,
-@@ -561,7 +581,13 @@
-     let compiler = c.get_compiler();
-     // FIXME: On Windows AArch64 we currently must use Clang to compile C code
-     let compiler = if target.os == WINDOWS && target.arch == AARCH64 && !compiler.is_like_clang() {
+@@ -561,14 +581,21 @@
+-    let compiler = c.get_compiler();
+-    // FIXME: On Windows AArch64 we currently must use Clang to compile C code
+-    let compiler = if target.os == WINDOWS && target.arch == AARCH64 && !compiler.is_like_clang() {
 -        let _ = c.compiler("clang");
-+        // Keep inherited MSVC flags compatible with the selected Clang driver.
-+        let clang = if compiler.is_like_msvc() {
-+            "clang-cl"
-+        } else {
-+            "clang"
-+        };
-+        let _ = c.compiler(clang);
-         c.get_compiler()
-     } else {
-         compiler
-@@ -569,6 +595,15 @@
+-        c.get_compiler()
+-    } else {
+-        compiler
++    // FIXME: On Windows AArch64 we currently must use Clang to compile C code.
++    // clang-cl emulates the cl.exe command line, `$CFLAGS`, etc.
++    if target.os == WINDOWS && target.arch == AARCH64 {
++        let _: &_ = c.prefer_clang_cl_over_msvc(true);
+     };
++    let compiler = c.get_compiler();
  
      let _ = c.include(c_root_dir.join("include"));
      let _ = c.include(include_dir);
diff --git a/patches/rules_cc_windows_native_llvm.patch b/patches/rules_cc_windows_native_llvm.patch
deleted file mode 100644
index 4bfef5bcfb..0000000000
--- a/patches/rules_cc_windows_native_llvm.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-# Reuse rules_cc's installed SDK setup with an explicitly declared LLVM repo.
-# Only the V8 repository has native_llvm; ordinary local_config_cc keeps its
-# installed compiler and input files. Track the fetched LLVM tools and resources
-# as action inputs so changes to the pin invalidate cached compilation and links.
-diff --git a/cc/private/toolchain/windows_cc_configure.bzl b/cc/private/toolchain/windows_cc_configure.bzl
---- a/cc/private/toolchain/windows_cc_configure.bzl
-+++ b/cc/private/toolchain/windows_cc_configure.bzl
-@@ -539,6 +539,12 @@
-         The path to the LLVM installation, or None if not found.
-     """
-
-+    # Codex's opt-in V8 toolchain supplies a Bazel-fetched compiler.
-+    # Ordinary cc_autoconf repositories have no such attribute.
-+    llvm_label = getattr(repository_ctx.attr, "native_llvm", None)
-+    if llvm_label:
-+        return str(repository_ctx.path(llvm_label).dirname).replace("/", "\\")
-+
-     # 1. Check if BAZEL_LLVM is already set by user.
-     bazel_llvm = _get_path_env_var(repository_ctx, "BAZEL_LLVM")
-     if bazel_llvm:
-@@ -602,7 +608,7 @@
-
- def _use_clang_cl(repository_ctx):
-     """Returns True if USE_CLANG_CL is set to 1."""
--    return _get_env_var(repository_ctx, "USE_CLANG_CL", default = "0") == "1"
-+    return getattr(repository_ctx.attr, "native_llvm", None) != None or _get_env_var(repository_ctx, "USE_CLANG_CL", default = "0") == "1"
-
- def _find_missing_llvm_tools(repository_ctx, llvm_path):
-     """Check if any required tool is missing under given LLVM path."""
-@@ -716,6 +722,7 @@
-
-         build_tools["CL"] = find_llvm_tool(repository_ctx, llvm_path, "clang-cl.exe")
-         build_tools["ML"] = find_msvc_tool(repository_ctx, vc_path, "ml64.exe", "x64")
-+        build_tools["DUMPBIN"] = find_msvc_tool(repository_ctx, vc_path, "dumpbin.exe", target_arch)
-         build_tools["LINK"] = find_llvm_tool(repository_ctx, llvm_path, "lld-link.exe")
-         if not build_tools["LINK"]:
-             build_tools["LINK"] = find_msvc_tool(repository_ctx, vc_path, "link.exe", "x64")
-@@ -923,6 +930,12 @@
-     )
-
-     template_vars = dict()
-+    native_llvm = getattr(repository_ctx.attr, "native_llvm", None)
-+    for group in ["compiler_files", "linker_files", "archiver_files", "all_files"]:
-+        files = [str(native_llvm.same_package_label(group))] if native_llvm else []
-+        if native_llvm and group == "all_files":
-+            files.append(":msvc_compiler_files")
-+        template_vars["%{native_llvm_" + group + "}"] = repr(files)
-     msvc_vars_x64 = _get_msvc_vars(repository_ctx, paths, "x64")
-     template_vars.update(msvc_vars_x64)
-     template_vars.update(_get_clang_cl_vars(repository_ctx, paths, msvc_vars_x64, "x64"))
-diff --git a/cc/private/toolchain/BUILD.windows.tpl b/cc/private/toolchain/BUILD.windows.tpl
---- a/cc/private/toolchain/BUILD.windows.tpl
-+++ b/cc/private/toolchain/BUILD.windows.tpl
-@@ -67,7 +67,22 @@
-         "%{msvc_deps_scanner_wrapper_path_x64}",
-         "%{msvc_deps_scanner_wrapper_path_arm}",
-         "%{msvc_deps_scanner_wrapper_path_arm64}",
--    ]
-+    ] + %{native_llvm_compiler_files}
-+)
-+
-+filegroup(
-+    name = "msvc_all_files",
-+    srcs = %{native_llvm_all_files},
-+)
-+
-+filegroup(
-+    name = "msvc_linker_files",
-+    srcs = %{native_llvm_linker_files},
-+)
-+
-+filegroup(
-+    name = "msvc_archiver_files",
-+    srcs = %{native_llvm_archiver_files},
- )
-
- # Hardcoded toolchain, legacy behaviour.
-@@ -301,12 +316,12 @@
-     name = "cc-compiler-x64_windows",
-     toolchain_identifier = "msvc_x64",
-     toolchain_config = ":msvc_x64",
--    all_files = ":empty",
--    ar_files = ":empty",
-+    all_files = ":msvc_all_files",
-+    ar_files = ":msvc_archiver_files",
-     as_files = ":msvc_compiler_files",
-     compiler_files = ":msvc_compiler_files",
-     dwp_files = ":empty",
--    linker_files = ":empty",
-+    linker_files = ":msvc_linker_files",
-     objcopy_files = ":empty",
-     strip_files = ":empty",
-     supports_param_files = 1,
-@@ -526,12 +541,12 @@
-     name = "cc-compiler-arm64_windows",
-     toolchain_identifier = "msvc_arm64",
-     toolchain_config = ":msvc_arm64",
--    all_files = ":empty",
--    ar_files = ":empty",
-+    all_files = ":msvc_all_files",
-+    ar_files = ":msvc_archiver_files",
-     as_files = ":msvc_compiler_files",
-     compiler_files = ":msvc_compiler_files",
-     dwp_files = ":empty",
--    linker_files = ":empty",
-+    linker_files = ":msvc_linker_files",
-     objcopy_files = ":empty",
-     strip_files = ":empty",
-     supports_param_files = 1,
diff --git a/patches/rules_rs_bindgen_v0_0_4.patch b/patches/rules_rs_bindgen_v0_0_4.patch
new file mode 100644
index 0000000000..df40794d81
--- /dev/null
+++ b/patches/rules_rs_bindgen_v0_0_4.patch
@@ -0,0 +1,62 @@
+# Adopt bindgen v0.0.4 with embedded LLVM 23.1.2 libclang.
+# https://github.com/hermeticbuild/bindgen/releases/tag/v0.0.4
+
+diff --git a/rs/rules_rust_bindgen.bzl b/rs/rules_rust_bindgen.bzl
+--- a/rs/rules_rust_bindgen.bzl
++++ b/rs/rules_rust_bindgen.bzl
+@@ -189,7 +189,7 @@
+             name = "rules_rust_bindgen_" + prebuilt.name,
+             build_file_content = 'exports_files(["%s"])\n' % bindgen_binary_name(prebuilt.os),
+             sha256 = prebuilt.sha256,
+-            url = "https://github.com/hermeticbuild/bindgen/releases/download/v0.0.2/bindgen_{}.tar.zst".format(prebuilt.name),
++            url = "https://github.com/hermeticbuild/bindgen/releases/download/v0.0.4/bindgen_{}.tar.zst".format(prebuilt.name),
+         )
+ 
+     toolchain_repositories = {"rules_rust_bindgen": True}
+diff --git a/rs/toolchains/declare_bindgen_toolchains.bzl b/rs/toolchains/declare_bindgen_toolchains.bzl
+--- a/rs/toolchains/declare_bindgen_toolchains.bzl
++++ b/rs/toolchains/declare_bindgen_toolchains.bzl
+@@ -5,37 +5,37 @@
+         name = "darwin_amd64",
+         cpu = "x86_64",
+         os = "macos",
+-        sha256 = "9effe0323d0441d6f541497e0590b970beb15b9104c7e034ac4557942202f869",
++        sha256 = "c541cffb54e6a4f683578147780f3fefaaba7a133da97f7d1a1a52dcf1cbaa6d",
+     ),
+     struct(
+         name = "darwin_arm64",
+         cpu = "aarch64",
+         os = "macos",
+-        sha256 = "456ab5235685c498455ddc2fafeba32eb1d93758346e585e8da5e09c19cc680c",
++        sha256 = "218d25da4d153dbc87daf64a029af3de17cee6a0f6291fdb0a5d9eff44243399",
+     ),
+     struct(
+         name = "linux_amd64",
+         cpu = "x86_64",
+         os = "linux",
+-        sha256 = "ec2b39a56443142a34dc76ec32a17cb099c6c09137c3fbac893310c623cb10ac",
++        sha256 = "146372dfdf4defd556ac9d7a6322cd49e397f663ef1a9f0144e108d4793b42fc",
+     ),
+     struct(
+         name = "linux_arm64",
+         cpu = "aarch64",
+         os = "linux",
+-        sha256 = "d4da684d021d1ebf40bb3819c1521c96c3ca51d22d911ee71731a358bd768594",
++        sha256 = "db19983cda00966857eace073e189b23304696cb6a7812c5a31c094cfda9ebac",
+     ),
+     struct(
+         name = "windows_amd64",
+         cpu = "x86_64",
+         os = "windows",
+-        sha256 = "beede8f802ab96a2cce0de84c560150dcbc89c96db94f7c17519dd164ac983fd",
++        sha256 = "20b895218d505efec3fb20d8cd457f8e9fbaabb643fa15d75d5eb25928b054a2",
+     ),
+     struct(
+         name = "windows_arm64",
+         cpu = "aarch64",
+         os = "windows",
+-        sha256 = "0885047b40b119e58fcca4491a2bd00331de131f41183de2a9b563ca407f9109",
++        sha256 = "8d61e41594d9e6ff29ce57a3177a8333a72c2c999e6fd030ab57324f7dab1a30",
+     ),
+ ]
+ 
diff --git a/patches/rules_rs_build_script_deps_annotation.patch b/patches/rules_rs_build_script_deps_annotation.patch
index 2f38c2bfed..5d4aa14f83 100644
--- a/patches/rules_rs_build_script_deps_annotation.patch
+++ b/patches/rules_rs_build_script_deps_annotation.patch
@@ -4,28 +4,29 @@
 diff --git a/rs/extensions.bzl b/rs/extensions.bzl
 --- a/rs/extensions.bzl
 +++ b/rs/extensions.bzl
-@@ -321,7 +321,7 @@ def _generate_hub_and_spokes(
+@@ -359,8 +359,8 @@ def _generate_hub_and_spokes(
          kwargs = dict(
              hub_name = hub_name,
+             crate_visibility = visibility_with_internal_access(annotation.visibility, internal_packages),
              gen_build_script = annotation.gen_build_script,
 -            build_script_deps = [],
 +            build_script_deps = annotation.build_script_deps,
              build_script_deps_select = _select(feature_resolutions.build_deps),
              build_script_data = annotation.build_script_data,
              build_script_data_select = annotation.build_script_data_select,
-@@ -881,9 +881,9 @@ _annotation = tag_class(
-         "build_script_data_select": _label_list_dict(
-             doc = "Labels to add to a crate's `cargo_build_script::data` attribute, keyed by platform triplet.",
-         ),
+@@ -1094,9 +1094,9 @@ _annotation = tag_class(
+         # "build_script_data_glob": attr.string_list(
+         #     doc = "A list of glob patterns to add to a crate's `cargo_build_script::data` attribute",
+         # ),
 -        # "build_script_deps": attr.label_list(
 -        #     doc = "A list of labels to add to a crate's `cargo_build_script::deps` attribute.",
 -        # ),
 +        "build_script_deps": attr.string_list(
 +            doc = "A list of labels to add to a crate's `cargo_build_script::deps` attribute.",
 +        ),
-         "build_script_env": attr.string_dict(
-             doc = "Additional environment variables to set on a crate's `cargo_build_script::env` attribute.",
-         ),
+         "build_script_env_files": attr.label_list(
+             doc = "Files containing additional environment variables for a crate's `cargo_build_script`.",
+             allow_files = True,
 diff --git a/rs/private/annotations.bzl b/rs/private/annotations.bzl
 --- a/rs/private/annotations.bzl
 +++ b/rs/private/annotations.bzl
diff --git a/patches/rules_rs_rust_debug_modes.patch b/patches/rules_rs_rust_debug_modes.patch
index e655ba7a56..eabf816a90 100644
--- a/patches/rules_rs_rust_debug_modes.patch
+++ b/patches/rules_rs_rust_debug_modes.patch
@@ -1,10 +1,9 @@
 diff --git a/rs/toolchains/declare_rustc_toolchains.bzl b/rs/toolchains/declare_rustc_toolchains.bzl
 --- a/rs/toolchains/declare_rustc_toolchains.bzl
 +++ b/rs/toolchains/declare_rustc_toolchains.bzl
-@@ -45,6 +45,14 @@
-             },
-         )
-         source_stdlib_building_select[config_setting] = "@rules_rs//rs/private:empty_stdlib"
+@@ -132,5 +132,13 @@
+             "//conditions:default": rust_std_label,
+         })
 +
 +    # Apple targets default to packed dSYMs and invoke dsymutil at link time.
 +    # The Linux remote Rust action has no dsymutil. Match Cargo release's
@@ -15,7 +14,7 @@ diff --git a/rs/toolchains/declare_rustc_toolchains.bzl b/rs/toolchains/declare_
 +    })
 -
 +
-     for triple in execs:
+     for triple in exec_triples:
          exec_triple = _parse_triple(triple)
 @@ -152,8 +160,20 @@
                  "//conditions:default": [],
diff --git a/patches/rules_rs_windows_msvc_linker.patch b/patches/rules_rs_windows_msvc_linker.patch
deleted file mode 100644
index 5056ade96b..0000000000
--- a/patches/rules_rs_windows_msvc_linker.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-# What: use Rust's bundled direct linker for Windows x86_64 and ARM64 MSVC toolchains.
-# Scope: standard and bootstrap rules_rs Rust toolchains targeting x86_64 and ARM64 MSVC.
-
-diff --git a/rs/toolchains/declare_rustc_toolchains.bzl b/rs/toolchains/declare_rustc_toolchains.bzl
---- a/rs/toolchains/declare_rustc_toolchains.bzl
-+++ b/rs/toolchains/declare_rustc_toolchains.bzl
-@@ -88,6 +88,8 @@ def declare_rustc_toolchains(
-             llvm_cov = "@llvm//tools:llvm-cov",
-             llvm_profdata = "@llvm//tools:llvm-profdata",
-             linker = select({
-+                "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": "{}rust-lld".format(rustc_repo_label),
-+                "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": "{}rust-lld".format(rustc_repo_label),
-                 "@platforms//cpu:wasm32": "{}rust-lld".format(rustc_repo_label),
-                 "@platforms//cpu:wasm64": "{}rust-lld".format(rustc_repo_label),
-                 "//conditions:default": None,
diff --git a/patches/rules_rs_workspace_package_version.patch b/patches/rules_rs_workspace_package_version.patch
index e55b838a8e..5c29459359 100644
--- a/patches/rules_rs_workspace_package_version.patch
+++ b/patches/rules_rs_workspace_package_version.patch
@@ -4,11 +4,12 @@
 diff --git a/rs/private/cargo_workspace_graph.bzl b/rs/private/cargo_workspace_graph.bzl
 --- a/rs/private/cargo_workspace_graph.bzl
 +++ b/rs/private/cargo_workspace_graph.bzl
-@@ -762,6 +762,8 @@ def workspace_dep_data(
+@@ -762,7 +762,9 @@ def workspace_dep_data(
              "deps": deps,
              "deps_by_platform": deps_by_platform,
              "dev_deps": dev_deps,
              "dev_deps_by_platform": dev_deps_by_platform,
+             "edition": package.get("edition", "2015"),
 +            "package_name": package["name"],
              "shared_libraries": shared_libraries,
 +            "version": package["version"],
diff --git a/patches/rules_rs_zlib_snapshot_urls.patch b/patches/rules_rs_zlib_snapshot_urls.patch
deleted file mode 100644
index d47ef76f56..0000000000
--- a/patches/rules_rs_zlib_snapshot_urls.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-# Fetch Linux zlib from Launchpad with the pinned Ubuntu snapshot as a fallback.
-# Follow https://github.com/hermeticbuild/rules_rs/commit/ee9a99d0a8e7784b3104dd188123750443cf2c26
-# while keeping this rules_rs version's package versions and SHA-256 hashes.
-
-diff --git a/rs/private/rustc_repository.bzl b/rs/private/rustc_repository.bzl
---- a/rs/private/rustc_repository.bzl
-+++ b/rs/private/rustc_repository.bzl
-@@ -11,11 +11,17 @@ _LINUX_ZLIB = {
-     "aarch64": struct(
-         libdir = "usr/lib/aarch64-linux-gnu",
-         sha256 = "cbe3d39ec32d3cc27c021ae4af11e7c67bdf9d700d573207e0941d4038056278",
--        url = "https://ports.ubuntu.com/ubuntu-ports/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_arm64.deb",
-+        url = [
-+            "https://launchpad.net/ubuntu/+archive/primary/+files/zlib1g_1.3.dfsg-3.1ubuntu2.1_arm64.deb",
-+            "https://snapshot.ubuntu.com/ubuntu/20260801T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_arm64.deb",
-+        ],
-     ),
-     "x86_64": struct(
-         libdir = "usr/lib/x86_64-linux-gnu",
-         sha256 = "7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20",
--        url = "https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb",
-+        url = [
-+            "https://launchpad.net/ubuntu/+archive/primary/+files/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb",
-+            "https://snapshot.ubuntu.com/ubuntu/20260801T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb",
-+        ],
-     ),
- }
diff --git a/patches/rules_rust_build_script_tools_transition.patch b/patches/rules_rust_build_script_tools_transition.patch
deleted file mode 100644
index dcbc456992..0000000000
--- a/patches/rules_rust_build_script_tools_transition.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_script.bzl
---- a/cargo/private/cargo_build_script.bzl
-+++ b/cargo/private/cargo_build_script.bzl
-@@ -396,3 +396,8 @@ def _cargo_build_script_impl(ctx):
-+    script_tools = []
-+    for target in ctx.attr.tools:
-+        script_tools.append(target[DefaultInfo].files)
-+        script_tools.append(target[DefaultInfo].default_runfiles.files)
-+
-     workspace_name = ctx.label.workspace_name
-     if not workspace_name:
-         workspace_name = ctx.workspace_name
-@@ -581,5 +586,5 @@ def _cargo_build_script_impl(ctx):
-         direct = [
-             ctx.executable._cargo_build_script_runner,
-         ] + ([toolchain.target_json] if toolchain.target_json else []),
--        transitive = script_data + toolchain_tools,
-+        transitive = script_data + script_tools + toolchain_tools,
-     )
diff --git a/patches/rules_rust_declared_msvc_linker.patch b/patches/rules_rust_declared_msvc_linker.patch
new file mode 100644
index 0000000000..dd62dd08ed
--- /dev/null
+++ b/patches/rules_rust_declared_msvc_linker.patch
@@ -0,0 +1,107 @@
+# rules_rust PR #92, commit 100616343e949f6744c5f01733cc42bf36c86d5e.
+# Use the selected C++ toolchain's declared lld-link for rustc.
+# Cargo retains clang-cl; explicit Rust linker preferences remain unchanged.
+
+diff --git a/rust/private/rustc.bzl b/rust/private/rustc.bzl
+index 5b206a6c0..a79bb6108 100644
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -412,6 +412,7 @@ _LinkerConfigInfo = provider(fields = [
+     "action_name",
+     "feature_configuration",
+     "is_direct_driver",
++    "msvc_lld_link",
+     "rpaths",
+     "rust_linker",
+     "target_abi",
+@@ -420,7 +421,14 @@ _LinkerConfigInfo = provider(fields = [
+     "variables",
+ ])
+ 
+-def _get_linker_config(ctx, crate_type, toolchain, cc_toolchain, feature_configuration, rpaths, add_flags_for_binary):
++def _get_cc_linker_files(cc_toolchain):
++    if not cc_toolchain:
++        return depset()
++    if hasattr(cc_toolchain, "_linker_files"):
++        return cc_toolchain._linker_files
++    return cc_toolchain.linker_files()
++
++def _get_linker_config(ctx, crate_type, toolchain, cc_toolchain, feature_configuration, rpaths, add_flags_for_binary, for_rustc = False):
+     user_link_flags = get_cc_user_link_flags(ctx)
+ 
+     cc_linker = None
+@@ -463,6 +471,19 @@ def _get_linker_config(ctx, crate_type, toolchain, cc_toolchain, feature_configu
+     if use_rust_linker and not toolchain.linker:
+         fail("No linker available for rustc. Either `rust_toolchain.linker` must be set or a `cc_toolchain` configured for the current configuration.")
+ 
++    msvc_lld_link = None
++    if for_rustc and not use_rust_linker and toolchain.target_os == "windows" and toolchain.target_abi == "msvc" and paths.basename(cc_linker).lower() in ("clang-cl", "clang-cl.exe"):
++        # rustc's MSVC interface sends LINK arguments, not clang-cl arguments.
++        # Keep Cargo's C/C++ driver unchanged and use only a declared sibling.
++        executable = "lld-link.exe" if cc_linker.lower().endswith(".exe") else "lld-link"
++        linker_path = paths.join(paths.dirname(cc_linker), executable)
++        for file in _get_cc_linker_files(cc_toolchain).to_list():
++            if file.path == linker_path:
++                msvc_lld_link = file
++                break
++        if not msvc_lld_link:
++            fail("Rust MSVC linking requires {} in cc_toolchain.linker_files when the C++ linker is {}. Alternatively, configure a direct MSVC linker in the Rust toolchain and set linker_preference = \"rust\".".format(linker_path, cc_linker))
++
+     # Keep CcToolchainVariables and the Rust linker File until map_each runs so
+     # cc_common and File.path use the Rustc action's path mapper.
+     return _LinkerConfigInfo(
+@@ -470,7 +491,8 @@ def _get_linker_config(ctx, crate_type, toolchain, cc_toolchain, feature_configu
+         action_name = action_name,
+         variables = link_variables,
+         rust_linker = toolchain.linker if use_rust_linker else None,
+-        is_direct_driver = use_rust_linker and toolchain.linker_type == "direct",
++        msvc_lld_link = msvc_lld_link,
++        is_direct_driver = bool(msvc_lld_link) or (use_rust_linker and toolchain.linker_type == "direct"),
+         target_abi = toolchain.target_abi,
+         target_arch = toolchain.target_arch,
+         target_os = toolchain.target_os,
+@@ -480,6 +502,8 @@ def _get_linker_config(ctx, crate_type, toolchain, cc_toolchain, feature_configu
+ def _get_linker_path(linker_config):
+     if linker_config.rust_linker:
+         return linker_config.rust_linker.path
++    if linker_config.msvc_lld_link:
++        return linker_config.msvc_lld_link.path
+     return cc_common.get_tool_for_action(
+         feature_configuration = linker_config.feature_configuration,
+         action_name = linker_config.action_name,
+@@ -538,7 +562,7 @@ def _get_linker_args(linker_config):
+             variables = linker_config.variables,
+         ))
+ 
+-    if linker_config.rust_linker:
++    if linker_config.rust_linker or linker_config.msvc_lld_link:
+         # Make sure we include RPATHs for Rust ABI dylibs even when no cc_toolchain.
+         if linker_config.variables == None and linker_config.rpaths:
+             for rpath in linker_config.rpaths.to_list():
+@@ -915,17 +939,7 @@ def collect_inputs(
+     """
+     linker_script = getattr(file, "linker_script", None)
+ 
+-    # TODO: As of writing this comment Bazel used Java CcToolchainInfo.
+-    # However there is ongoing work to rewrite provider in Starlark.
+-    # rules_rust is not coupled with Bazel release. Remove conditional and change to
+-    # _linker_files once Starlark CcToolchainInfo is visible to Bazel.
+-    # https://github.com/bazelbuild/rules_rust/issues/2425
+-    if not cc_toolchain:
+-        linker_depset = depset()
+-    elif hasattr(cc_toolchain, "_linker_files"):
+-        linker_depset = cc_toolchain._linker_files
+-    else:
+-        linker_depset = cc_toolchain.linker_files()
++    linker_depset = _get_cc_linker_files(cc_toolchain)
+     compilation_mode = ctx.var["COMPILATION_MODE"]
+ 
+     use_pic = should_use_pic(
+@@ -1586,6 +1600,7 @@ def construct_arguments(
+                 feature_configuration,
+                 rpaths,
+                 add_flags_for_binary = add_flags_for_binary,
++                for_rustc = True,
+             )
+ 
+             ld_is_direct_driver = linker_config.is_direct_driver
diff --git a/patches/rules_rust_release_build_script_profile.patch b/patches/rules_rust_release_build_script_profile.patch
index a849512e9a..ae9493a13c 100644
--- a/patches/rules_rust_release_build_script_profile.patch
+++ b/patches/rules_rust_release_build_script_profile.patch
@@ -7,11 +7,11 @@
 +load("@platforms//host:constraints.bzl", "HOST_CONSTRAINTS")
  load("@rules_cc//cc:action_names.bzl", "ACTION_NAMES")
  load("@rules_cc//cc/common:cc_common.bzl", "cc_common")
- load("//rust:defs.bzl", "rust_common")
-@@ -11,6 +12,7 @@
- # buildifier: disable=bzl-visibility
+ load("//cargo/private:cargo_toolchain.bzl", "cargo_version_mismatch", "find_cargo")
+@@ -12,6 +13,7 @@
  load(
      "//rust/private:rustc.bzl",
+     "collect_cfg_query_rustc_flags",
 +    "collect_extra_rustc_flags",
      "get_compilation_mode_opts",
      "get_linker_and_args",
@@ -66,8 +66,23 @@
 +    ]
 +    return [flag for flag in flags if flag not in profile_defaults]
 
- def get_cc_compile_args_and_env(cc_toolchain, feature_configuration):
+ def get_cc_compile_args_and_env(ctx, cc_toolchain, feature_configuration):
      """Gather cc environment variables from the given `cc_toolchain`
+@@ -94,12 +94,12 @@
+     c_compile_variables = cc_common.create_compile_variables(
+         feature_configuration = feature_configuration,
+         cc_toolchain = cc_toolchain,
+-        user_compile_flags = ctx.fragments.cpp.copts + ctx.fragments.cpp.conlyopts,
++        user_compile_flags = [] if _feature_enabled(ctx, "cargo-release-profile") else ctx.fragments.cpp.copts + ctx.fragments.cpp.conlyopts,
+     )
+     cxx_compile_variables = cc_common.create_compile_variables(
+         feature_configuration = feature_configuration,
+         cc_toolchain = cc_toolchain,
+-        user_compile_flags = ctx.fragments.cpp.copts + ctx.fragments.cpp.cxxopts,
++        user_compile_flags = [] if _feature_enabled(ctx, "cargo-release-profile") else ctx.fragments.cpp.copts + ctx.fragments.cpp.cxxopts,
+     )
+     cc_c_args = cc_common.get_memory_inefficient_command_line(
+         feature_configuration = feature_configuration,
 @@ -469,6 +509,22 @@
          env["CARGO_PKG_VERSION_PRE"] = patch[1] if len(patch) > 1 else ""
          env["CARGO_PKG_VERSION"] = ctx.attr.version
@@ -88,13 +103,13 @@
 +                debug_info = codegen.removeprefix("debuginfo=")
 +        env["DEBUG"] = "false" if debug_info in ["0", "none"] else "true"
 +
-     # Pull in env vars which may be required for the cc_toolchain to work (e.g. on OSX, the SDK version).
-     # We hope that the linker env is sufficient for the whole cc_toolchain.
-     cc_toolchain, feature_configuration = find_cc_toolchain(ctx)
+     use_cc_toolchain = _resolve_tristate(
+         ctx.attr.use_cc_toolchain,
+         ctx.attr._default_use_cc_toolchain,
 @@ -484,6 +540,13 @@
      if cc_toolchain:
          # MSVC requires INCLUDE to be set
-         cc_c_args, cc_cxx_args, cc_env = get_cc_compile_args_and_env(cc_toolchain, feature_configuration)
+         cc_c_args, cc_cxx_args, cc_env = get_cc_compile_args_and_env(ctx, cc_toolchain, feature_configuration)
 +        if cargo_release_profile:
 +            # Preserve SDK, ABI, CRT and security options. User copts and crate
 +            # build_script_env overrides retain precedence over these defaults.
diff --git a/patches/rules_rust_windows_execroot_separators.patch b/patches/rules_rust_windows_execroot_separators.patch
index 187b37f48c..2bd0152c29 100644
--- a/patches/rules_rust_windows_execroot_separators.patch
+++ b/patches/rules_rust_windows_execroot_separators.patch
@@ -1,14 +1,19 @@
 --- a/cargo/private/cargo_build_script_runner/lib.rs
 +++ b/cargo/private/cargo_build_script_runner/lib.rs
-@@ -337,9 +337,18 @@
+@@ -377,14 +377,23 @@
              return "${pwd}".to_owned();
          }
  
 -        value
 +        let redacted = value
              .replace(&format!("{exec_root}/"), "${pwd}/")
--            .replace(&format!("{exec_root}\\"), "${pwd}\\")
-+            .replace(&format!("{exec_root}\\"), "${pwd}\\");
+             .replace(&format!("{exec_root}\\"), "${pwd}\\")
+             // Flags such as `--remap-path-prefix=<exec_root>=.` (which build
+             // scripts see in CARGO_ENCODED_RUSTFLAGS and may echo back as
+             // `cargo:rustc-env`) follow the exec root with `=`. Leaving it
+             // unredacted bakes the per-action sandbox path into the output.
+-            .replace(&format!("{exec_root}="), "${pwd}=")
++            .replace(&format!("{exec_root}="), "${pwd}=");
 +        #[cfg(windows)]
 +        let redacted = {
 +            // pkg-config can emit forward slashes for the same Windows root.
@@ -21,9 +26,9 @@
      }
  
      /// Redact for env vars: uses the generic `${out_dir}` token, resolved
-@@ -630,6 +639,28 @@
-                 link_search_paths:
-                     "-L${pwd}/${bazel-out/cfg/bin/pkg/_bs.out_dir}\n-L${pwd}/other/path".to_owned(),
+@@ -736,6 +745,26 @@
+                 cdylib_link_flags: "".to_owned(),
+                 bin_link_flags: "".to_owned(),
              }
 +        );
 +    }
@@ -31,7 +36,8 @@
 +    #[cfg(windows)]
 +    #[test]
 +    fn windows_include_metadata_redacts_both_root_spellings() {
-+        let root = r"D:\o\execroot\_main";
++        let directory = std::env::current_dir().unwrap();
++        let root = directory.to_str().unwrap();
 +        let forward = root.replace('\\', "/");
 +        let outputs = vec![BuildScriptOutput::DepEnv(format!(
 +            "INCLUDE={forward}/include;{root}\\lib;{forward}-other/include"
@@ -40,12 +46,9 @@
 +            BuildScriptOutput::outputs_to_dep_env(&outputs, "glib", root),
 +            format!("DEP_GLIB_INCLUDE=${{pwd}}/include;${{pwd}}\\lib;{forward}-other/include")
 +        );
-+        let directory = std::env::current_dir().unwrap();
-+        let directory = directory.to_str().unwrap();
-+        let forward = directory.replace('\\', "/");
 +        let outputs = vec![BuildScriptOutput::DepEnv(format!("INCLUDE={forward}/."))];
 +        assert_eq!(
-+            BuildScriptOutput::nonhermetic_absolute_paths(&outputs, directory, ""),
++            BuildScriptOutput::nonhermetic_absolute_paths(&outputs, root, ""),
 +            Vec::<String>::new()
          );
      }
diff --git a/patches/rules_rust_windows_msvc_direct_link_args.patch b/patches/rules_rust_windows_msvc_direct_link_args.patch
deleted file mode 100644
index a8eba2ba6e..0000000000
--- a/patches/rules_rust_windows_msvc_direct_link_args.patch
+++ /dev/null
@@ -1,109 +0,0 @@
---- a/rust/private/rustc.bzl
-+++ b/rust/private/rustc.bzl
-@@ -438,4 +438,11 @@
-     use_bpf_linker = toolchain.target_arch in ("bpfeb", "bpfel") and toolchain.linker
--    if not ld or toolchain.linker_preference == "rust" or use_bpf_linker:
-+    use_windows_msvc_linker = (
-+        toolchain.target_arch in ("x86_64", "aarch64") and
-+        toolchain.target_os == "windows" and
-+        toolchain.target_abi == "msvc" and
-+        toolchain.linker != None and
-+        toolchain.linker_preference != "cc"
-+    )
-+    if not ld or toolchain.linker_preference == "rust" or use_bpf_linker or use_windows_msvc_linker:
-         ld = toolchain.linker.path
-         ld_is_direct_driver = toolchain.linker_type == "direct"
-@@ -468,11 +468,25 @@
-                     filtered_args.append(version)
-                     # Keep library search path flags
-
-+                elif processed_arg == "-L" and i + 1 < len(link_args):
-+                    path = link_args[i + 1]
-+                    if ld_is_direct_driver and toolchain.target_os == "windows" and toolchain.target_abi == "msvc":
-+                        skip_next = True
-+                        continue
-+                    filtered_args.extend([processed_arg, path])
-+                    skip_next = True
-+
-                 elif processed_arg.startswith("-L"):
-+                    if ld_is_direct_driver and toolchain.target_os == "windows" and toolchain.target_abi == "msvc":
-+                        continue
-                     filtered_args.append(processed_arg)
-                     # Keep sysroot flags (as single or two-part arguments)
- 
-                 elif processed_arg == "--sysroot" or processed_arg.startswith("--sysroot="):
-+                    if ld_is_direct_driver and toolchain.target_os == "windows" and toolchain.target_abi == "msvc":
-+                        if processed_arg == "--sysroot" and i + 1 < len(link_args):
-+                            skip_next = True
-+                        continue
-                     filtered_args.append(processed_arg)
-                     if processed_arg == "--sysroot" and i + 1 < len(link_args):
-                         # Two-part argument, keep the next arg too
-@@ -2943,8 +2957,10 @@
-         use_pic,
-         ambiguous_libs,
-         get_lib_name,
-+        for_windows = False,
-         for_darwin = False,
--        flavor_msvc = False):
-+        flavor_msvc = False,
-+        use_direct_driver = False):
-     """_summary_
-
-     Args:
-@@ -2952,8 +2968,10 @@
-         use_pic (_type_): _description_
-         ambiguous_libs (_type_): _description_
-         get_lib_name (_type_): _description_
-+        for_windows (bool, optional): _description_. Defaults to False.
-         for_darwin (bool, optional): _description_. Defaults to False.
-         flavor_msvc (bool, optional): _description_. Defaults to False.
-+        use_direct_driver (bool, optional): _description_. Defaults to False.
-
-     Returns:
-         _type_: _description_
-@@ -2997,6 +3015,11 @@
-         ):
-             return [] if for_darwin else ["-lstatic=%s" % get_lib_name(artifact)]
- 
-+        if for_windows and flavor_msvc and use_direct_driver and not artifact.basename.endswith(".lib"):
-+            return [
-+                "-Clink-arg={}".format(artifact.path),
-+            ]
-+
-         if flavor_msvc:
-             return [
-                 "-lstatic=%s" % get_lib_name(artifact),
-@@ -3045,7 +3068,7 @@
-                 ])
-         elif include_link_flags:
-             get_lib_name = get_lib_name_for_windows if flavor_msvc else get_lib_name_default
--            ret.extend(portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, flavor_msvc = flavor_msvc))
-+            ret.extend(portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, for_windows = True, flavor_msvc = flavor_msvc, use_direct_driver = use_direct_driver))
- 
-     # Windows toolchains can inherit POSIX defaults like -pthread from C deps,
-     # which fails to link with the MinGW/LLD toolchain. Drop them here.
-@@ -3257,11 +3280,18 @@
-                 format_each = "-Lnative=%s",
-             )
-             if include_link_flags:
--                args.add_all(
--                    runtime_libs,
--                    map_each = get_lib_name,
--                    format_each = static_runtime_link_format,
--                )
-+                if toolchain.target_os == "windows" and toolchain.target_abi == "msvc" and use_direct_link_driver:
-+                    for runtime_lib in runtime_libs.to_list():
-+                        if runtime_lib.basename.endswith(".lib"):
-+                            args.add(get_lib_name(runtime_lib), format = static_runtime_link_format)
-+                        else:
-+                            args.add(runtime_lib.path, format = "--codegen=link-arg=%s")
-+                else:
-+                    args.add_all(
-+                        runtime_libs,
-+                        map_each = get_lib_name,
-+                        format_each = static_runtime_link_format,
-+                    )
- 
- def _get_dirname(file):
-     """A helper function for `_add_native_link_flags`.
diff --git a/patches/rules_rust_windows_process_wrapper_skip_temp_outputs.patch b/patches/rules_rust_windows_process_wrapper_skip_temp_outputs.patch
deleted file mode 100644
index 52c5ae8652..0000000000
--- a/patches/rules_rust_windows_process_wrapper_skip_temp_outputs.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/util/process_wrapper/main.rs
-+++ b/util/process_wrapper/main.rs
-@@ -213,6 +213,12 @@ fn consolidate_dependency_search_paths(
-             let file_name_lower = file_name
-                 .to_string_lossy()
-                 .to_ascii_lowercase();
-+            if file_name_lower.contains(".tmp") || file_name_lower.ends_with(".rcgu.o") {
-+                // Native Windows Rust link actions can leave transient `*.exe.tmp*` and
-+                // per-codegen-unit `*.rcgu.o` outputs next to the final binary.
-+                // Those are not stable linker search-path inputs.
-+                continue;
-+            }
-             if !seen.insert(file_name_lower) {
-                 continue;
-             }
diff --git a/third_party/openssl/BUILD.bazel b/third_party/openssl/BUILD.bazel
new file mode 100644
index 0000000000..03b0dc32c8
--- /dev/null
+++ b/third_party/openssl/BUILD.bazel
@@ -0,0 +1 @@
+exports_files(["openssl_sys.BUILD.bazel"])
diff --git a/third_party/openssl/openssl_sys.BUILD.bazel b/third_party/openssl/openssl_sys.BUILD.bazel
new file mode 100644
index 0000000000..7fe8071cfc
--- /dev/null
+++ b/third_party/openssl/openssl_sys.BUILD.bazel
@@ -0,0 +1,50 @@
+load("@package_metadata//rules:package_metadata.bzl", "package_metadata")
+load("@rules_rs//rs:cargo_build_script.bzl", "cargo_build_script")
+load("@rules_rs//rs:rust_library.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+package_metadata(
+    name = "openssl-sys_package_metadata",
+    purl = "pkg:cargo/openssl-sys@0.9.118",
+)
+
+# Deliberately omit vendored/openssl-src: the native library belongs to @openssl.
+# Keep the upstream build script for header checks, cfgs, and link metadata.
+cargo_build_script(
+    name = "build_script",
+    srcs = glob(["build/*.rs"]),
+    build_script_env = {
+        "OPENSSL_DIR": "$(execpath @openssl//:gen_dir)",
+        "OPENSSL_NO_VENDOR": "1",
+        "OPENSSL_STATIC": "1",
+    },
+    crate_name = "build_script_build",
+    crate_root = "build/main.rs",
+    data = glob(["build/**"]) + ["@openssl//:gen_dir"],
+    edition = "2021",
+    links = "openssl",
+    pkg_name = "openssl-sys",
+    rustc_env = {"CARGO_PKG_VERSION": "0.9.118"},
+    version = "0.9.118",
+    deps = [
+        "@crates//:cc-1.2.55",
+        "@crates//:pkg-config-0.3.32",
+        "@crates//:vcpkg-0.2.15",
+    ],
+)
+
+rust_library(
+    name = "openssl-sys",
+    srcs = glob(["src/**/*.rs"]),
+    crate_name = "openssl_sys",
+    crate_root = "src/lib.rs",
+    data = ["@openssl//:gen_dir"],
+    edition = "2021",
+    package_metadata = ["openssl-sys_package_metadata"],
+    version = "0.9.118",
+    deps = [
+        "build_script",
+        "@crates//:libc-0.2.186",
+    ],
+)
diff --git a/third_party/sqlite/BUILD.bazel b/third_party/sqlite/BUILD.bazel
new file mode 100644
index 0000000000..10687f7e1d
--- /dev/null
+++ b/third_party/sqlite/BUILD.bazel
@@ -0,0 +1,69 @@
+load("@bazel_lib//lib:copy_to_directory.bzl", "copy_to_directory")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("sqlite_build_info.bzl", "sqlite_build_info")
+
+package(default_visibility = ["//visibility:public"])
+
+exports_files([
+    "libsqlite3_sys.BUILD.bazel",
+])
+
+# Use bindings and native code from the same libsqlite3-sys release.
+copy_to_directory(
+    name = "sqlite_bindings",
+    srcs = ["@crates//:libsqlite3_sys_bindings"],
+    include_external_repositories = ["*"],
+    replace_prefixes = {"sqlite3/bindgen_bundled_version.rs": "bindgen.rs"},
+)
+
+sqlite_build_info(
+    name = "libsqlite3_sys_build_info",
+    cc_lib = "sqlite3",
+    out_dir = "sqlite_bindings",
+)
+
+# Match libsqlite3-sys's bundled build without embedding build.rs's worker path.
+# Internal compilation options must not leak into dependent C/C++ targets.
+cc_library(
+    name = "sqlite3",
+    srcs = ["@crates//:libsqlite3_sys_source"],
+    linkopts = select({
+        "@platforms//os:freebsd": ["-lpthread"],
+        "@platforms//os:linux": [
+            "-lpthread",
+            "-ldl",
+        ],
+        "@platforms//os:netbsd": ["-lpthread"],
+        "@platforms//os:openbsd": ["-lpthread"],
+        "//conditions:default": [],
+    }),
+    linkstatic = True,
+    local_defines = [
+        "SQLITE_CORE",
+        "SQLITE_DEFAULT_FOREIGN_KEYS=1",
+        "SQLITE_ENABLE_API_ARMOR",
+        "SQLITE_ENABLE_COLUMN_METADATA",
+        "SQLITE_ENABLE_DBSTAT_VTAB",
+        "SQLITE_ENABLE_FTS3",
+        "SQLITE_ENABLE_FTS3_PARENTHESIS",
+        "SQLITE_ENABLE_FTS5",
+        "SQLITE_ENABLE_JSON1",
+        "SQLITE_ENABLE_LOAD_EXTENSION=1",
+        "SQLITE_ENABLE_RTREE",
+        "SQLITE_ENABLE_STAT4",
+        "SQLITE_SOUNDEX",
+        "SQLITE_THREADSAFE=1",
+        "SQLITE_USE_URI",
+        "HAVE_USLEEP=1",
+        "HAVE_ISNAN",
+        "_POSIX_THREAD_SAFE_FUNCTIONS",
+    ] + select({
+        "@platforms//os:windows": [],
+        "//conditions:default": ["HAVE_LOCALTIME_R"],
+    }) + select({
+        # Preserve Codex's workaround for older x64 Windows CPUs.
+        "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ["SQLITE_DISABLE_INTRINSIC"],
+        "//conditions:default": [],
+    }),
+    deps = ["@crates//:libsqlite3_sys_headers"],
+)
diff --git a/third_party/sqlite/libsqlite3_sys.BUILD.bazel b/third_party/sqlite/libsqlite3_sys.BUILD.bazel
new file mode 100644
index 0000000000..3daa7a16af
--- /dev/null
+++ b/third_party/sqlite/libsqlite3_sys.BUILD.bazel
@@ -0,0 +1,16 @@
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+
+exports_files(
+    [
+        "sqlite3/bindgen_bundled_version.rs",
+        "sqlite3/sqlite3.c",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+cc_library(
+    name = "sqlite3_headers",
+    hdrs = ["sqlite3/sqlite3.h"],
+    includes = ["sqlite3"],
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/sqlite/sqlite_build_info.bzl b/third_party/sqlite/sqlite_build_info.bzl
new file mode 100644
index 0000000000..b2a2a2a8f1
--- /dev/null
+++ b/third_party/sqlite/sqlite_build_info.bzl
@@ -0,0 +1,30 @@
+"""Supply libsqlite3-sys's bindings and Bazel-owned native library."""
+
+load("@rules_cc//cc:defs.bzl", "CcInfo")
+load("@rules_rust//rust/private:providers.bzl", "BuildInfo")
+
+def _sqlite_build_info_impl(ctx):
+    out_dir = ctx.file.out_dir
+    if not out_dir.is_directory:
+        fail("out_dir must be a directory")
+
+    return [
+        BuildInfo(
+            compile_data = depset(),
+            dep_env = None,
+            flags = None,
+            linker_flags = None,
+            link_search_paths = None,
+            out_dir = out_dir,
+            rustc_env = None,
+        ),
+        ctx.attr.cc_lib[CcInfo],
+    ]
+
+sqlite_build_info = rule(
+    implementation = _sqlite_build_info_impl,
+    attrs = {
+        "cc_lib": attr.label(mandatory = True, providers = [CcInfo]),
+        "out_dir": attr.label(allow_single_file = True, mandatory = True),
+    },
+)
diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index 908e9a3edf..fb42ceb9ce 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -1,15 +1,17 @@
 load("@@//third_party/v8:artifact_profile.bzl", "v8_artifact_files")
 load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 load("@rules_cc//cc:cc_static_library.bzl", "cc_static_library")
-load("@rules_cc//cc:defs.bzl", "cc_library")
+load("@rules_cc//cc:defs.bzl", "cc_import", "cc_library")
 load("@rules_rs//rs:rules_rust_bindgen.bzl", "rust_bindgen")
 
 package(default_visibility = ["//visibility:public"])
 
 exports_files([
     "abseil.BUILD.bazel",
+    "abseil_lifetime_capture.patch",
     "abseil_repository.bzl",
     "artifact_profile.bzl",
+    "binary.bzl",
     "dependencies.bzl",
     "dependency_config.bzl",
     "dragonbox.BUILD.bazel",
@@ -22,6 +24,8 @@ exports_files([
     "icu.BUILD.bazel",
     "libcxx_rules.bzl",
     "native_windows.bzl",
+    "windows_snapshot.bzl",
+    "v8_windows_snapshot_wine.patch",
     "push_registers_gnullvm.S",
     "simdutf.BUILD.bazel",
     "v8_defs.patch",
@@ -134,14 +138,14 @@ alias(
     actual = select({
         "@rules_rs//rs/platforms/config:aarch64-apple-darwin": ":v8_152_2_0_aarch64_apple_darwin_bazel",
         "@rules_rs//rs/platforms/config:aarch64-pc-windows-gnullvm": ":v8_152_2_0_aarch64_pc_windows_gnullvm",
-        "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":v8_152_2_0_aarch64_pc_windows_msvc_bazel",
+        "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":v8_152_2_0_aarch64_pc_windows_msvc_workspace",
         "@llvm//platforms/config:linux_aarch64_gnu": ":v8_152_2_0_aarch64_unknown_linux_gnu_bazel",
         # Rust's compiler-builtins archive does not supply V8's __clear_cache.
         # Use the merged archive containing the ARM64 compiler-rt builtins.
         "@llvm//platforms/config:linux_aarch64_musl": ":v8_152_2_0_aarch64_unknown_linux_musl_release",
         "@rules_rs//rs/platforms/config:x86_64-apple-darwin": ":v8_152_2_0_x86_64_apple_darwin_bazel",
         "@rules_rs//rs/platforms/config:x86_64-pc-windows-gnullvm": ":v8_152_2_0_x86_64_pc_windows_gnullvm",
-        "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":v8_152_2_0_x86_64_pc_windows_msvc_bazel",
+        "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":v8_152_2_0_x86_64_pc_windows_msvc_workspace",
         "@llvm//platforms/config:linux_x86_64_gnu": ":v8_152_2_0_x86_64_unknown_linux_gnu_bazel",
         "@llvm//platforms/config:linux_x86_64_musl": ":v8_152_2_0_x86_64_unknown_linux_musl_release",
         "//conditions:default": ":v8_152_2_0_x86_64_unknown_linux_gnu_bazel",
@@ -173,12 +177,12 @@ alias(
     actual = select({
         "@rules_rs//rs/platforms/config:aarch64-apple-darwin": ":src_binding_aarch64_apple_darwin_152_2_0_bazel",
         "@rules_rs//rs/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_aarch64_pc_windows_gnullvm_152_2_0_bazel",
-        "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":src_binding_aarch64_pc_windows_msvc_152_2_0_bazel",
+        "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":src_binding_aarch64_pc_windows_msvc_152_2_0_workspace",
         "@llvm//platforms/config:linux_aarch64_gnu": ":src_binding_aarch64_unknown_linux_gnu_152_2_0_bazel",
         "@llvm//platforms/config:linux_aarch64_musl": ":src_binding_aarch64_unknown_linux_musl_152_2_0_bazel",
         "@rules_rs//rs/platforms/config:x86_64-apple-darwin": ":src_binding_x86_64_apple_darwin_152_2_0_bazel",
         "@rules_rs//rs/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_x86_64_pc_windows_gnullvm_152_2_0_bazel",
-        "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":src_binding_x86_64_pc_windows_msvc_152_2_0_bazel",
+        "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":src_binding_x86_64_pc_windows_msvc_152_2_0_workspace",
         "@llvm//platforms/config:linux_x86_64_gnu": ":src_binding_x86_64_unknown_linux_gnu_152_2_0_bazel",
         "@llvm//platforms/config:linux_x86_64_musl": ":src_binding_x86_64_unknown_linux_musl_152_2_0_bazel",
         "//conditions:default": ":src_binding_x86_64_unknown_linux_gnu_152_2_0_bazel",
@@ -301,9 +305,9 @@ cc_library(
     }),
 )
 
-alias(
+cc_import(
     name = "native_windows_compiler_builtins",
-    actual = "@v8_native_windows_llvm//:builtins",
+    static_library = "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
     tags = ["manual"],
     target_compatible_with = select({
         ":platform_windows_msvc": [],
@@ -326,30 +330,33 @@ cc_static_library(
     ],
 )
 
-# cc_static_library only collects object files, not prebuilt libraries.
-# The Rust build script receives one .lib without Bazel's CcInfo/linkdeps, so
-# merge compiler-rt into the staged artifact explicitly.
+# cc_static_library does not collect objects from imported archives. Merge the
+# source-built compiler-rt archive with the declared exec-platform llvm-lib.
 genrule(
     name = "v8_152_2_0_native_windows_library",
     srcs = [
         ":v8_152_2_0_native_windows_objects",
-        "@v8_native_windows_llvm//:builtins_archive",
+        "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
     ],
     outs = ["rusty_v8_native_windows.lib"],
-    cmd_bat = '""$(location @v8_native_windows_llvm//:llvm-lib)" /NOLOGO /OUT:"$@" "$(location :v8_152_2_0_native_windows_objects)" "$(location @v8_native_windows_llvm//:builtins_archive)""',
+    cmd = '"$(execpath @llvm//tools:llvm-lib)" /NOLOGO /OUT:"$@" "$(location :v8_152_2_0_native_windows_objects)" "$(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static)"',
+    cmd_bat = '""$(execpath @llvm//tools:llvm-lib)" /NOLOGO /OUT:"$@" "$(location :v8_152_2_0_native_windows_objects)" "$(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static)""',
     tags = ["manual"],
     target_compatible_with = [
         "@platforms//os:windows",
         "@llvm//constraints/windows/abi:msvc",
     ],
-    tools = ["@v8_native_windows_llvm//:llvm-lib"],
+    tools = ["@llvm//tools:llvm-lib"],
 )
 
+# Workspace binaries use the hermetic toolchain's ISO stdio ABI. Distributed
+# archives must link with the stock MSVC CRT. Generate a matching binding for
+# each archive under the same profile.
 [
     v8_artifact_files(
-        name = "v8_152_2_0_%s_pc_windows_msvc_bazel" % arch,
-        srcs = [":v8_152_2_0_native_windows_library"],
-        profile = "sandbox_release",
+        name = label_pattern % (arch, suffix),
+        srcs = [source],
+        profile = profile,
         tags = ["manual"],
         target_compatible_with = [
             "@platforms//cpu:%s" % arch,
@@ -362,6 +369,14 @@ genrule(
         ("x86_64", "x64"),
         ("aarch64", "arm64"),
     ]
+    for label_pattern, source in [
+        ("v8_152_2_0_%s_pc_windows_msvc_%s", ":v8_152_2_0_native_windows_library"),
+        ("src_binding_%s_pc_windows_msvc_152_2_0_%s", ":binding_generated_152_2_0"),
+    ]
+    for suffix, profile in [
+        ("workspace", "source"),
+        ("bazel", "sandbox_release"),
+    ]
 ]
 
 # Producer selectors never fall back to published inputs. Keep them separate
@@ -419,8 +434,7 @@ rust_bindgen(
     clang_flags = [
         "-x",
         "c++",
-        "-std=c++20",
-    ] + V8_CUSTOM_LIBCXX_COPTS + select({
+    ] + V8_COPTS + V8_CUSTOM_LIBCXX_COPTS + select({
         # Match the C++ toolchain. Bindgen asks for C flags and otherwise
         # enables C++20 modules, for which the macOS SDK's types are cyclic.
         "@platforms//os:osx": [
@@ -444,32 +458,6 @@ rust_bindgen(
     tags = ["manual"],
 )
 
-v8_artifact_files(
-    name = "src_binding_aarch64_pc_windows_msvc_152_2_0_bazel",
-    srcs = [":binding_generated_152_2_0"],
-    profile = "sandbox_release",
-    tags = ["manual"],
-    target_compatible_with = [
-        "@platforms//cpu:aarch64",
-        "@platforms//os:windows",
-        "@llvm//constraints/windows/abi:msvc",
-    ],
-    v8_cpu = "arm64",
-)
-
-v8_artifact_files(
-    name = "src_binding_x86_64_pc_windows_msvc_152_2_0_bazel",
-    srcs = [":binding_generated_152_2_0"],
-    profile = "sandbox_release",
-    tags = ["manual"],
-    target_compatible_with = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:windows",
-        "@llvm//constraints/windows/abi:msvc",
-    ],
-    v8_cpu = "x64",
-)
-
 v8_artifact_files(
     name = "src_binding_aarch64_pc_windows_gnullvm_152_2_0_bazel",
     srcs = [":binding_generated_152_2_0"],
diff --git a/third_party/v8/README.md b/third_party/v8/README.md
index 9b74a8d8a0..97e0e2874a 100644
--- a/third_party/v8/README.md
+++ b/third_party/v8/README.md
@@ -123,16 +123,35 @@ revision must keep the native GNU link/runtime checks passing. The Bazel pair
 targets above point directly to source targets so a new release or canary never
 depends on an older published copy.
 
-Native Windows x64 and ARM64 hosts can build sandbox archives and matching
-Rust bindings with pinned clang-cl and the installed Microsoft SDK using
+Windows x64 and ARM64 sandbox archives and matching Rust bindings use the
+selected hermetic `@llvm` clang-cl toolchain and its declared Microsoft SDK:
 `//third_party/v8:v8_152_2_0_x86_64_pc_windows_msvc_bazel` and
 `//third_party/v8:v8_152_2_0_aarch64_pc_windows_msvc_bazel`.
 The producer selectors `//third_party/v8:rusty_v8_native_windows_archive_for_target`
 and `//third_party/v8:rusty_v8_native_windows_binding_for_target` select source
 outputs directly. Both use the same sandbox, pointer compression, target CPU,
 and Chromium libc++ profile. The bindings use V8's compiled headers and defines
-so their sizes follow the archive, including CppGC members. Bazel MSVC consumers
-use the newly built archive and bindings together.
+so their sizes follow the archive, including CppGC members.
+
+The Windows distribution archive uses the published MSVC wide-stdio mode
+(`_CRT_STDIO_ISO_WIDE_SPECIFIERS=0`) for V8, Chromium libc++ and their native
+dependencies. Native Windows CI checks the COFF directives and links and runs a
+stock MSVC C++ consumer that includes `<cstdio>` and calls
+`v8__V8__IsSandboxEnabled()` on both x64 and ARM64. Cargo runs the V8 runtime
+tests against that staged archive and its generated bindings.
+
+In-tree Bazel consumers link a separate source-built archive with the hermetic
+toolchain's ISO stdio mode (`1`) and matching bindings. Both pairs use the
+same V8 source, sandbox configuration and pinned Chromium libc++.
+
+Binding generation uses the published hermeticbuild bindgen v0.0.4
+executables through the standard rules_rs toolchain. Their embedded LLVM
+23.1.2 libclang matches the selected LLVM resource headers; Codex does not
+build bindgen or libclang from source.
+
+Binding generation reuses `V8_COPTS`, including native `/std:c++20` on MSVC.
+The clang-cl bindgen action passes toolchain and caller arguments through in CL
+driver mode instead of translating their header-search or warning semantics.
 
 The owned engine policy preserves the GN MSVC defaults for GC-managed microtask
 queues, random Wasm module generation, disabled imminent-deprecation warnings,
@@ -142,29 +161,39 @@ bindings use that same threshold; never pair a native 64-byte threshold with
 GN's size-zero binding constant. These are fixed platform choices, not additional
 developer build switches.
 
-Use a native Visual Studio Developer PowerShell with the C++ tools and Windows
-SDK available. The SDK supplies headers, libraries, `dumpbin.exe`, and the
-assembler. From the repo root, build the archive for that host:
+Private libc++ profiles set `@llvm//config:nostdincxx` and explicitly supply
+Chromium's pinned libc++ headers and archive. The Windows MSVC profile also
+sets `@llvm//config:nostdlibxx`. These settings are target-scoped: unrelated execution
+tools retain their default C++ runtime. V8's own generator binaries explicitly
+reapply the private-runtime policy after the execution transition. Neither flag
+suppresses C headers, the SDK, CRT, compiler-rt, or the independent unwinder.
 
-```powershell
-bazel build --config=ci-windows-msvc `
-  --host_platform=//:local_windows_msvc --platforms=//:local_windows_msvc `
-  //third_party/v8:rusty_v8_native_windows_archive_for_target `
+Build with Linux remote execution and the static CRT:
+
+```sh
+bazel build --config=buildbuddy-generic-rbe --host_platform=//:rbe \
+  --platforms=@llvm//platforms:windows_x86_64_msvc \
+  --extra_execution_platforms=//:rbe \
+  --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1 \
+  --repo_env=BAZEL_WINDOWS_SDK_EULA=1 \
+  --features=-dynamic_link_msvcrt --features=static_link_msvcrt \
+  --features=cargo-rebase-json-vfs-overlays \
+  //third_party/v8:rusty_v8_native_windows_archive_for_target \
   //third_party/v8:rusty_v8_native_windows_binding_for_target
 ```
 
-Bazel fetches and verifies LLVM 22.1.8 for the host, the same major and patch
-version as the libclang that generates bindings. The V8 artifact profile selects
-clang-cl, lld-link, llvm-lib and compiler-rt only for its Windows MSVC source
-archive and bindings, together with the installed SDK. Bazel consumers now
-cross this same boundary automatically. Other C++
-dependencies in the same `ci-windows-msvc` build keep the installed MSVC
-compiler; no whole-build V8 compiler flag is needed.
+Torque and other ordinary generators execute on Linux. The MSVC snapshot
+generator is a Windows payload compiled with the same `@llvm` toolchain.
+`rules_wine` selects direct execution on Windows or its pinned Wine runtime on
+Linux. Linux ARM64 workers use the runtime's bundled FEX to run the x64 generator;
+both x64 and ARM64 targets use the existing `//:rbe` platform. This keeps V8's
+Windows-host unwind writer enabled, including generated `.pdata`/`.xdata`.
+Select `@llvm//platforms:windows_aarch64_msvc` for an ARM64 build.
 
-This is a native Windows build, not an x64-to-ARM64 or remote Linux build:
-V8's snapshot generator must execute on the target architecture. The repository
-inputs pinned in #4009 are MSVC/SDK files, not a registered clang-cl toolchain;
-making them replace the installed SDK is the separate hermetic MSVC migration.
+Native Windows ARM64 uses an ARM64 generator for ARM64 snapshots. Other MSVC
+combinations use the x64 generator, including V8's x64-hosted ARM64 generator.
+The existing GNU snapshot action and its Windows-local CI execution remain
+unchanged. The existing MSVC assembly-to-C++ conversion is also retained.
 
 Release and CI Cargo builds for Darwin and Linux use `RUSTY_V8_ARCHIVE` plus a
 downloaded `RUSTY_V8_SRC_BINDING_PATH` to point at those `openai/codex` release
diff --git a/third_party/v8/abseil_lifetime_capture.patch b/third_party/v8/abseil_lifetime_capture.patch
new file mode 100644
index 0000000000..66f3aaafc1
--- /dev/null
+++ b/third_party/v8/abseil_lifetime_capture.patch
@@ -0,0 +1,131 @@
+# Backport of abseil/abseil-cpp 0784689a65b4ea1329fbc5174b8a57c88ec796a9.
+# Adapted to 20250814.1: prefer Clang 23 lifetime_capture_by_this, retain older compiler fallback.
+diff --git a/absl/base/attributes.h b/absl/base/attributes.h
+--- a/absl/base/attributes.h
++++ b/absl/base/attributes.h
+@@ -911,6 +911,23 @@
+ #define ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(Owner)
+ #endif
+ 
++// Internal attribute; name and documentation TBD.
++//
++// See the upstream documentation:
++// https://clang.llvm.org/docs/AttributeReference.html#lifetime_capture_by_this
++//
++// Note: ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this) is deprecated. Use
++// ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS instead.
++#if ABSL_HAVE_CPP_ATTRIBUTE(clang::lifetime_capture_by_this)
++#define ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS \
++  [[clang::lifetime_capture_by_this]]
++#elif ABSL_HAVE_CPP_ATTRIBUTE(clang::lifetime_capture_by)
++#define ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS \
++  ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this)
++#else
++#define ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS
++#endif
++
+ // ABSL_ATTRIBUTE_VIEW indicates that a type is solely a "view" of data that it
+ // points to, similarly to a span, string_view, or other non-owning reference
+ // type.
+diff --git a/absl/base/internal/spinlock.h b/absl/base/internal/spinlock.h
+--- a/absl/base/internal/spinlock.h
++++ b/absl/base/internal/spinlock.h
+@@ -242,1 +242,1 @@
+-      SpinLock& l ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++      SpinLock& l ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+diff --git a/absl/container/internal/btree_container.h b/absl/container/internal/btree_container.h
+--- a/absl/container/internal/btree_container.h
++++ b/absl/container/internal/btree_container.h
+@@ -508,1 +508,1 @@
+-          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this)),                        \
++          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS),                        \
+@@ -510,1 +510,1 @@
+-          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this)))                        \
++          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS))                        \
+@@ -610,1 +610,1 @@
+-          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this)),                          \
++          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS),                          \
+@@ -637,1 +637,1 @@
+-      const key_arg<K> &k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++      const key_arg<K> &k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -646,2 +646,1 @@
+-  mapped_type &operator[](key_arg<K> &&k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(
+-      this)) ABSL_ATTRIBUTE_LIFETIME_BOUND {
++  mapped_type &operator[](key_arg<K> &&k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS) ABSL_ATTRIBUTE_LIFETIME_BOUND {
+diff --git a/absl/container/internal/raw_hash_map.h b/absl/container/internal/raw_hash_map.h
+--- a/absl/container/internal/raw_hash_map.h
++++ b/absl/container/internal/raw_hash_map.h
+@@ -117,1 +117,1 @@
+-          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this)),                          \
++          ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS),                          \
+@@ -118,2 +118,1 @@
+-      V VQual v ABSL_INTERNAL_IF_##VValue(ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY( \
+-          this))) ABSL_ATTRIBUTE_LIFETIME_BOUND {                              \
++      V VQual v ABSL_INTERNAL_IF_##VValue(ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)) ABSL_ATTRIBUTE_LIFETIME_BOUND {                              \
+@@ -216,1 +215,1 @@
+-      key_arg<K> &&k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++      key_arg<K> &&k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
+@@ -235,1 +234,1 @@
+-      const key_arg<K> &k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++      const key_arg<K> &k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
+@@ -249,1 +248,1 @@
+-                       key_arg<K> &&k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++                       key_arg<K> &&k ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
+@@ -265,1 +264,1 @@
+-                           ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++                           ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
+@@ -305,1 +304,1 @@
+-      key_arg<K> &&key ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++      key_arg<K> &&key ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -322,1 +321,1 @@
+-      const key_arg<K> &key ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++      const key_arg<K> &key ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+diff --git a/absl/container/internal/raw_hash_set.h b/absl/container/internal/raw_hash_set.h
+--- a/absl/container/internal/raw_hash_set.h
++++ b/absl/container/internal/raw_hash_set.h
+@@ -2428,1 +2428,1 @@
+-      T&& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++      T&& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -2457,1 +2457,1 @@
+-      const T& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++      const T& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -2477,1 +2477,1 @@
+-      init_type&& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++      init_type&& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -2499,1 +2499,1 @@
+-                  T&& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++                  T&& value ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+diff --git a/absl/status/statusor.h b/absl/status/statusor.h
+--- a/absl/status/statusor.h
++++ b/absl/status/statusor.h
+@@ -408,1 +408,1 @@
+-  StatusOr& operator=(U&& v ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this)) {
++  StatusOr& operator=(U&& v ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS) {
+diff --git a/absl/synchronization/mutex.h b/absl/synchronization/mutex.h
+--- a/absl/synchronization/mutex.h
++++ b/absl/synchronization/mutex.h
+@@ -604,1 +604,1 @@
+-  explicit MutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++  explicit MutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -619,1 +619,1 @@
+-  explicit MutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++  explicit MutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
+@@ -646,1 +646,1 @@
+-  explicit ReaderMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++  explicit ReaderMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -655,1 +655,1 @@
+-  explicit ReaderMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++  explicit ReaderMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
+@@ -682,1 +682,1 @@
+-  explicit WriterMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this))
++  explicit WriterMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS)
+@@ -692,1 +692,1 @@
+-  explicit WriterMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++  explicit WriterMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
+@@ -1096,2 +1096,1 @@
+-  explicit ReleasableMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(
+-      this)) ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
++  explicit ReleasableMutexLock(Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS) ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
+@@ -1107,1 +1106,1 @@
+-      Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY(this),
++      Mutex& mu ABSL_INTERNAL_ATTRIBUTE_CAPTURED_BY_THIS,
diff --git a/third_party/v8/abseil_repository.bzl b/third_party/v8/abseil_repository.bzl
index 7e1ee85980..9e6574f10a 100644
--- a/third_party/v8/abseil_repository.bzl
+++ b/third_party/v8/abseil_repository.bzl
@@ -13,6 +13,7 @@ def _v8_abseil_repository_impl(repository_ctx):
         integrity = "sha256-FpL3fRc5us8/lDNxiLeFg88JurfkINLcbFYFpPhnhaE=",
         stripPrefix = "abseil-cpp-20250814.1",
     )
+    repository_ctx.patch(repository_ctx.attr.lifetime_capture_patch, strip = 1)
 
     # Our root BUILD must own all sources beneath absl/. Native Starlark
     # filesystem operations work on Windows as well; no shell or Python.
@@ -49,6 +50,10 @@ def _v8_abseil_repository_impl(repository_ctx):
 v8_abseil_repository = repository_rule(
     implementation = _v8_abseil_repository_impl,
     attrs = {
+        "lifetime_capture_patch": attr.label(
+            default = Label("//third_party/v8:abseil_lifetime_capture.patch"),
+            allow_single_file = True,
+        ),
         "build_file": attr.label(
             default = Label("//third_party/v8:abseil.BUILD.bazel"),
             allow_single_file = True,
diff --git a/third_party/v8/artifact_profile.bzl b/third_party/v8/artifact_profile.bzl
index 6263d0ce8f..3f96e1be0f 100644
--- a/third_party/v8/artifact_profile.bzl
+++ b/third_party/v8/artifact_profile.bzl
@@ -1,7 +1,8 @@
 """Complete V8 artifact profiles, enforced at the source archive boundary.
 
-The source profile is for local consumers and uses the workspace C++ runtime.
-Published profiles embed the pinned Chromium runtime. Generators inherit the
+Native Windows builds embed Chromium libc++ with the consumer's stdio ABI.
+Other source profiles use the workspace C++ runtime. Published profiles embed
+the pinned Chromium runtime. Generators inherit the
 V8 target CPU even when their executable is built for the exec platform.
 """
 
@@ -9,11 +10,16 @@ _POINTER_COMPRESSION = "@v8//:v8_enable_pointer_compression"
 _SANDBOX = "@v8//:v8_enable_sandbox"
 _LIBCXX = "@v8//:v8_use_rusty_v8_custom_libcxx"
 _TARGET_CPU = "@v8//bazel/config:v8_target_cpu"
-_TOOLCHAINS = "//command_line_option:extra_toolchains"
-_NATIVE_WINDOWS_TOOLCHAINS = [
-    str(Label("@v8_native_windows_cc//:cc-toolchain-x64_windows")),
-    str(Label("@v8_native_windows_cc//:cc-toolchain-arm64_windows")),
-]
+_TARGET_OS = "@v8//:v8_target_os"
+_MSVC_PROFILE = "@v8//:v8_windows_msvc_profile"
+
+# The published MSVC archives use the Windows SDK's native wide-stdio mode.
+# Apply this after clang-cl's default ISO define to the entire archive graph.
+_MSVC_NATIVE_STDIO_COPT = "-U_CRT_STDIO_ISO_WIDE_SPECIFIERS"
+
+_COPT = "//command_line_option:copt"
+_NOSTDINCXX = "@llvm//config:nostdincxx"
+_NOSTDLIBXX = "@llvm//config:nostdlibxx"
 _CPU_CONSTRAINTS = {
     "arm64": Label("@platforms//cpu:aarch64"),
     "x64": Label("@platforms//cpu:x86_64"),
@@ -21,20 +27,28 @@ _CPU_CONSTRAINTS = {
 
 def _artifact_profile_impl(settings, attr):
     sandbox = attr.profile != "release"
+    use_chromium_libcxx = attr.native_windows or attr.profile != "source"
+    copts = settings[_COPT]
+    if attr.native_windows and attr.profile != "source":
+        copts = copts + [_MSVC_NATIVE_STDIO_COPT]
     return {
+        _COPT: copts,
         _POINTER_COMPRESSION: "True" if sandbox else "False",
         _SANDBOX: sandbox,
-        _LIBCXX: attr.profile != "source",
+        _LIBCXX: use_chromium_libcxx,
         _TARGET_CPU: attr.v8_cpu,
-        # Select clang-cl only below the V8 archive/binding boundary. Keep the
-        # caller's toolchains (including the ordinary MSVC compiler) elsewhere.
-        _TOOLCHAINS: settings[_TOOLCHAINS] + (_NATIVE_WINDOWS_TOOLCHAINS if attr.native_windows else []),
+        # Like GN's target_os, these settings survive the exec transition.
+        # Windows snapshot generators run under Wine on Linux.
+        _TARGET_OS: attr.target_os,
+        _MSVC_PROFILE: attr.native_windows,
+        _NOSTDINCXX: True if use_chromium_libcxx else settings[_NOSTDINCXX],
+        _NOSTDLIBXX: True if attr.native_windows else settings[_NOSTDLIBXX],
     }
 
 _artifact_profile = transition(
     implementation = _artifact_profile_impl,
-    inputs = [_TOOLCHAINS],
-    outputs = [_POINTER_COMPRESSION, _SANDBOX, _LIBCXX, _TARGET_CPU, _TOOLCHAINS],
+    inputs = [_COPT, _NOSTDINCXX, _NOSTDLIBXX],
+    outputs = [_COPT, _POINTER_COMPRESSION, _SANDBOX, _LIBCXX, _TARGET_CPU, _TARGET_OS, _MSVC_PROFILE, _NOSTDINCXX, _NOSTDLIBXX],
 )
 
 def _profiled_files_impl(ctx):
@@ -57,6 +71,7 @@ _v8_artifact_files = rule(
     doc = "Build a source archive or release pair under its named V8 profile.",
     attrs = {
         "native_windows": attr.bool(mandatory = True),
+        "target_os": attr.string(mandatory = True),
         "profile": attr.string(
             mandatory = True,
             values = ["source", "release", "sandbox_release"],
@@ -90,6 +105,13 @@ def v8_artifact_files(name, v8_cpu, **kwargs):
             "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": True,
             "//conditions:default": False,
         }),
+        target_os = select({
+            "@platforms//os:windows": "win",
+            "@platforms//os:macos": "mac",
+            "@platforms//os:linux": "linux",
+            "@platforms//os:android": "android",
+            "//conditions:default": "",
+        }),
         v8_cpu = v8_cpu,
         **kwargs
     )
diff --git a/third_party/v8/binary.bzl b/third_party/v8/binary.bzl
new file mode 100644
index 0000000000..0939cd98b9
--- /dev/null
+++ b/third_party/v8/binary.bzl
@@ -0,0 +1,19 @@
+"""Apply V8's private runtime policy after a generator's exec transition."""
+
+load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
+load("@with_cfg.bzl", "with_cfg")
+
+_PRIVATE_RUNTIME = select({
+    str(Label("//third_party/v8:use_rusty_v8_custom_libcxx")): True,
+    "//conditions:default": False,
+})
+
+# LLVM's flags are target-scoped. V8 generators intentionally share V8's
+# private libc++ profile, but unrelated tools must keep their default runtime.
+v8_cc_binary, _v8_cc_binary_internal = with_cfg(cc_binary).set(
+    Label("@llvm//config:nostdincxx"),
+    _PRIVATE_RUNTIME,
+).set(
+    Label("@llvm//config:nostdlibxx"),
+    _PRIVATE_RUNTIME,
+).build()
diff --git a/third_party/v8/engine.BUILD.bazel b/third_party/v8/engine.BUILD.bazel
index ac15cf3ad2..1b92612b44 100644
--- a/third_party/v8/engine.BUILD.bazel
+++ b/third_party/v8/engine.BUILD.bazel
@@ -30,6 +30,28 @@ v8_flag(name = "v8_enable_sandbox")
 
 v8_flag(name = "v8_use_rusty_v8_custom_libcxx")
 
+# Generator code executes on the exec platform but emits target-ABI snapshots.
+# Match V8 15.2.124.1 BUILD.gn's target_os (not current_os) definitions.
+v8_flag(name = "v8_windows_msvc_profile")
+
+v8_string(
+    name = "v8_target_os",
+    visibility = ["//visibility:public"],
+)
+
+[
+    config_setting(
+        name = "v8_target_os_" + os,
+        flag_values = {":v8_target_os": os},
+    )
+    for os in [
+        "android",
+        "linux",
+        "mac",
+        "win",
+    ]
+]
+
 # Maglev is supported on the two architectures shipped by Codex. Keep the
 # architecture tests separate from feature policy for host-tool transitions.
 selects.config_setting_group(
@@ -130,7 +152,7 @@ v8_config(
     ] + select({
         # The published MSVC artifacts used GN's CppGC queue and Wasm fuzzers.
         # Keep these choices in the owned policy, including snapshot generators.
-        "@@//third_party/v8:platform_windows_msvc": [
+        ":is_v8_windows_msvc_profile": [
             "V8_CPPGC_MICROTASK_QUEUE",
             "V8_WASM_RANDOM_FUZZERS",
             "V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=0",
@@ -193,26 +215,31 @@ v8_config(
         },
         no_match_error = "Please specify a target cpu supported by v8",
     ) + select({
-        "@v8//bazel/config:is_android": [
+        ":v8_target_os_android": [
             "V8_HAVE_TARGET_OS",
             "V8_TARGET_OS_ANDROID",
         ],
-        "@v8//bazel/config:is_linux": [
+        ":v8_target_os_linux": [
             "V8_HAVE_TARGET_OS",
             "V8_TARGET_OS_LINUX",
         ],
-        "@v8//bazel/config:is_macos": [
+        ":v8_target_os_mac": [
             "V8_HAVE_TARGET_OS",
             "V8_TARGET_OS_MACOS",
         ],
-        "@v8//bazel/config:is_windows": [
+        ":v8_target_os_win": [
             "V8_HAVE_TARGET_OS",
             "V8_TARGET_OS_WIN",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "@v8//bazel/config:is_windows": [
             "UNICODE",
             "_UNICODE",
             "_CRT_RAND_S",
             "_WIN32_WINNT=0x0A00",
         ],
+        "//conditions:default": [],
     }) + select({
         ":is_v8_enable_pointer_compression": [
             "V8_COMPRESS_POINTERS",
@@ -301,18 +328,17 @@ alias(
 
 alias(
     name = "is_v8_wasm_random_fuzzers",
-    actual = "@@//third_party/v8:platform_windows_msvc",
+    actual = ":is_v8_windows_msvc_profile",
 )
 
 # @CODEX_V8_UPSTREAM_FILEGROUPS@
 
 filegroup(
     name = "windows_x64_stack_assembly",
-    # The import preserves upstream MASM; only GNU builds use our GAS source.
-    srcs = select({
-        "@@//third_party/v8:platform_windows_msvc": ["src/heap/base/asm/x64/push_registers_masm.asm"],
-        "//conditions:default": ["@@//third_party/v8:push_registers_gnullvm.S"],
-    }),
+    # Windows x64 ABI and SEH metadata, assembled by @llvm's integrated assembler.
+    # The existing GAS translation matches the pinned MASM scanner instruction
+    # for instruction; its syntax is not a dependency on the GNU Windows ABI.
+    srcs = ["@@//third_party/v8:push_registers_gnullvm.S"],
 )
 
 alias(
diff --git a/third_party/v8/libcxx_rules.bzl b/third_party/v8/libcxx_rules.bzl
index f8c5ecde7d..9c6f4428ac 100644
--- a/third_party/v8/libcxx_rules.bzl
+++ b/third_party/v8/libcxx_rules.bzl
@@ -1,4 +1,4 @@
-"""Select the installed SDK-capable toolchain for native Windows libc++."""
+"""Build Windows libc++ with the selected target toolchain and its declared SDK."""
 
 load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
 load("@rules_cc//cc:defs.bzl", "cc_library")
diff --git a/third_party/v8/native_windows_stdio_probe.cc b/third_party/v8/native_windows_stdio_probe.cc
new file mode 100644
index 0000000000..901b33c609
--- /dev/null
+++ b/third_party/v8/native_windows_stdio_probe.cc
@@ -0,0 +1,9 @@
+#include <cstdio>
+
+extern "C" bool v8__V8__IsSandboxEnabled();
+
+int main() {
+  if (!v8__V8__IsSandboxEnabled()) return 1;
+  std::puts("V8 sandbox enabled");
+  return 0;
+}
diff --git a/third_party/v8/v8_defs.patch b/third_party/v8/v8_defs.patch
index 9b4c41d5e9..928204d979 100644
--- a/third_party/v8/v8_defs.patch
+++ b/third_party/v8/v8_defs.patch
@@ -10,6 +10,12 @@
 diff --git a/orig/v8-15.2.124.1/bazel/defs.bzl b/mod/v8-15.2.124.1/bazel/defs.bzl
 --- a/orig/v8-15.2.124.1/bazel/defs.bzl
 +++ b/mod/v8-15.2.124.1/bazel/defs.bzl
+@@ -8,4 +8,4 @@
+
+ load("@rules_cc//cc:cc_library.bzl", "cc_library")
+-load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
++load("@@//third_party/v8:binary.bzl", cc_binary = "v8_cc_binary")
+ load("@rules_cc//cc/common:cc_common.bzl", "cc_common")
 @@ -19,7 +19,7 @@
 
  _create_option_flag = rule(
diff --git a/third_party/v8/v8_windows_snapshot_wine.patch b/third_party/v8/v8_windows_snapshot_wine.patch
new file mode 100644
index 0000000000..4c461382f5
--- /dev/null
+++ b/third_party/v8/v8_windows_snapshot_wine.patch
@@ -0,0 +1,66 @@
+--- a/orig/v8-15.2.124.1/bazel/defs.bzl
++++ b/mod/v8-15.2.124.1/bazel/defs.bzl
+@@ -6,6 +6,7 @@
+ This module contains helper functions to compile V8.
+ """
+ 
++load("@@//third_party/v8:windows_snapshot.bzl", "windows_snapshot_rule")
+ load("@rules_cc//cc:cc_library.bzl", "cc_library")
+ load("@@//third_party/v8:binary.bzl", cc_binary = "v8_cc_binary")
+ load("@rules_cc//cc/common:cc_common.bzl", "cc_common")
+@@ -586,8 +587,45 @@
+     cfg = v8_target_cpu_transition,
+ )
+ 
++
++_v8_windows_mksnapshot = windows_snapshot_rule(v8_target_cpu_transition)
++
++def _platform_mksnapshot(name, args, tool, **kwargs):
++    _v8_mksnapshot(
++        name = name + "_native",
++        args = args,
++        tool = tool,
++        target_compatible_with = select({
++            "@@//third_party/v8:platform_windows_msvc": ["@platforms//:incompatible"],
++            "//conditions:default": [],
++        }),
++        **kwargs
++    )
++    _v8_windows_mksnapshot(
++        name = name + "_windows",
++        args = args,
++        tool = tool,
++        inline_asm_converter = kwargs["inline_asm_converter"],
++        platform_arch = select({
++            "@platforms//cpu:aarch64": "aarch64",
++            "@platforms//cpu:x86_64": "x86_64",
++        }),
++        target_arch = select({
++            "@v8//bazel/config:v8_target_arm64": "arm64",
++            "@v8//bazel/config:v8_target_x64": "x64",
++        }),
++        target_compatible_with = ["@platforms//os:windows", "@llvm//constraints/windows/abi:msvc"],
++    )
++    native.alias(
++        name = name,
++        actual = select({
++            "@@//third_party/v8:platform_windows_msvc": ":" + name + "_windows",
++            "//conditions:default": ":" + name + "_native",
++        }),
++    )
++
+ def v8_mksnapshot(name, args, suffix = ""):
+-    _v8_mksnapshot(
++    _platform_mksnapshot(
+         name = "noicu/" + name,
+         args = args,
+         prefix = "noicu",
+@@ -604,7 +642,7 @@
+             "//conditions:default": "",
+         }),
+     )
+-    _v8_mksnapshot(
++    _platform_mksnapshot(
+         name = "icu/" + name,
+         args = args,
+         prefix = "icu",
diff --git a/third_party/v8/windows_snapshot.bzl b/third_party/v8/windows_snapshot.bzl
new file mode 100644
index 0000000000..f0c3e09d39
--- /dev/null
+++ b/third_party/v8/windows_snapshot.bzl
@@ -0,0 +1,100 @@
+"""Run a Windows V8 snapshot generator natively or with declared Wine.
+
+V8 15.2's Windows unwind writer is guarded by the generator's host OS. A Linux
+generator with V8_TARGET_OS_WIN would silently omit embedded .pdata/.xdata.
+The generator's Windows compilation platform is distinct from its executor.
+"""
+
+load("@rules_wine//wine:actions.bzl", "windows_actions")
+
+def _windows_generator_platform_impl(settings, attr):
+    # Preserve the target's build mode, features and V8 profile. Select the
+    # executable matching the runner only after toolchain resolution. Only
+    # that executable is an action input; the other variant is not built.
+    return {
+        arch: {
+            # Keep the caller's platform identity when no CPU change is needed.
+            # Distinct labels with the same platform name can otherwise produce
+            # conflicting C++ actions under --experimental_platform_in_output_dir.
+            "//command_line_option:platforms": settings["//command_line_option:platforms"] if arch == attr.platform_arch else [str(Label(platform))],
+        }
+        for arch, platform in {
+            "x86_64": "@llvm//platforms:windows_x86_64_msvc",
+            "aarch64": "@llvm//platforms:windows_aarch64_msvc",
+        }.items()
+    }
+
+_windows_generator_platform = transition(
+    implementation = _windows_generator_platform_impl,
+    inputs = ["//command_line_option:platforms"],
+    outputs = ["//command_line_option:platforms"],
+)
+
+def _windows_snapshot_impl(ctx):
+    runner = windows_actions.resolve(ctx)
+
+    # Wine's ARM64 distribution runs x64 generators through FEX. Native
+    # Windows ARM64 uses an ARM64 generator for ARM64 snapshots; retain an
+    # x64 generator for x64 snapshots because V8 has no x64 simulator.
+    native_arm64 = runner.windows.backend == "native" and runner.windows.arch == "aarch64" and ctx.attr.target_arch == "arm64"
+    generator_arch = "aarch64" if native_arm64 else "x86_64"
+    generator = ctx.split_attr.tool[generator_arch][DefaultInfo].files_to_run
+    outputs = [
+        ctx.actions.declare_file(ctx.label.name + "/snapshot.cc"),
+        ctx.actions.declare_file(ctx.label.name + "/embedded.S"),
+    ]
+    args = ctx.actions.args()
+    args.add_all([
+        "--embedded_variant=Default",
+        "--target_os",
+        "win",
+        "--target_arch",
+        ctx.attr.target_arch,
+    ])
+    args.add("--startup_src")
+    windows_actions.add_path(runner, args, outputs[0])
+    args.add("--embedded_src")
+    windows_actions.add_path(runner, args, outputs[1])
+    args.add_all(ctx.attr.args)
+    windows_actions.run(
+        ctx,
+        runner = runner,
+        executable = generator,
+        arguments = [args],
+        outputs = outputs,
+        mnemonic = "V8WindowsSnapshot",
+        progress_message = "Generating Windows V8 snapshot",
+    )
+
+    # Preserve the existing clang-cl assembly path, including Windows-native
+    # toolchains that otherwise send generated .S files to MASM.
+    embedded_cc = ctx.actions.declare_file(ctx.label.name + "/embedded.cc")
+    ctx.actions.run(
+        executable = ctx.attr.inline_asm_converter[DefaultInfo].files_to_run,
+        inputs = [outputs[1]],
+        outputs = [embedded_cc],
+        arguments = [outputs[1].path, embedded_cc.path],
+        mnemonic = "V8NativeWindowsInlineAssembly",
+    )
+    return [DefaultInfo(files = depset([outputs[0], embedded_cc]))]
+
+def windows_snapshot_rule(cpu_transition):
+    """Preserve V8's target CPU independently of the generator and its runner."""
+    return rule(
+        implementation = _windows_snapshot_impl,
+        cfg = cpu_transition,
+        attrs = {
+            "args": attr.string_list(),
+            "platform_arch": attr.string(mandatory = True, values = ["aarch64", "x86_64"]),
+            "target_arch": attr.string(mandatory = True, values = ["arm64", "x64"]),
+            "tool": attr.label(
+                mandatory = True,
+                cfg = _windows_generator_platform,
+            ),
+            "_allowlist_function_transition": attr.label(
+                default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
+            ),
+            "inline_asm_converter": attr.label(executable = True, cfg = "exec", mandatory = True),
+        },
+        toolchains = [windows_actions.toolchain_type],
+    )
diff --git a/third_party/voice/BUILD.bazel b/third_party/voice/BUILD.bazel
index 94adba1b5e..2ae8fe634a 100644
--- a/third_party/voice/BUILD.bazel
+++ b/third_party/voice/BUILD.bazel
@@ -157,6 +157,16 @@ toolchain(
     visibility = ["//visibility:public"],
 )
 
+# Like the pinned Windows CMake, this executable can run under x64 emulation
+# on Windows ARM64. Avoid foreign_cc's fallback bootstrap through ambient cl.exe.
+toolchain(
+    name = "windows_ninja_toolchain",
+    exec_compatible_with = ["@platforms//os:windows"],
+    toolchain = "@ninja_1.13.0_win//:ninja_tool",
+    toolchain_type = "@rules_foreign_cc//toolchains:ninja_toolchain",
+    visibility = ["//visibility:public"],
+)
+
 filegroup(
     name = "archives",
     srcs = [
diff --git a/third_party/voice/build_native.py b/third_party/voice/build_native.py
index 58d482894d..2bc7ce5a8e 100644
--- a/third_party/voice/build_native.py
+++ b/third_party/voice/build_native.py
@@ -294,9 +294,19 @@ class NativeBuild:
                 for name, flags in self.flags.items()
             }
         )
+        languages = {"c": "CFLAGS", "cpp": "CXXFLAGS"}
         if self.args.target.endswith("apple-darwin"):
             self.environment["OBJC"] = str(self.toolchain["cc"])
             self.environment["OBJCFLAGS"] = self.environment["CFLAGS"]
+            languages["objc"] = "CFLAGS"
+        # Environment CFLAGS are also linked for Autotools compatibility. Use
+        # Meson's phase-specific options to preserve Bazel's toolchain contract.
+        meson_flags = []
+        for language, variable in languages.items():
+            meson_flags += [
+                f"-D{language}_args={json.dumps([*self.flags[variable], include])}",
+                f"-D{language}_link_args={json.dumps([*self.flags['LDFLAGS'], *link])}",
+            ]
         self.run(
             name + "-configure",
             [
@@ -311,6 +321,7 @@ class NativeBuild:
                 "-Dauto_features=disabled",
                 "-Ddefault_library=shared",
                 "-Dpkgconfig.relocatable=true",
+                *meson_flags,
                 *options,
             ],
         )
diff --git a/third_party/voice/cargo-ci/produce/action.yml b/third_party/voice/cargo-ci/produce/action.yml
index d1d39fbfe1..d3e4b8b4c9 100644
--- a/third_party/voice/cargo-ci/produce/action.yml
+++ b/third_party/voice/cargo-ci/produce/action.yml
@@ -42,8 +42,8 @@ runs:
         if [[ "$RUNNER_OS" == Windows ]]; then
           wrapper+=(--windows-msvc-host-platform)
           flags+=(--platforms=//:local_windows_msvc
-            --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows,@local_config_cc//:cc-toolchain-arm64_windows,//third_party/voice:windows_pkg_config_toolchain,//third_party/voice:windows_cmake_toolchain
-            --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=0 --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1
+            --extra_toolchains=//third_party/voice:windows_pkg_config_toolchain,//third_party/voice:windows_cmake_toolchain
+            --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1
             --inject_repository="voice_windows_tools=$VOICE_WINDOWS_BAZEL_REPOSITORY"
             --//third_party/voice:windows_installed_tools=@voice_windows_tools//:tools
             --action_env="SystemRoot=$VOICE_WINDOWS_SYSTEM_ROOT" --host_action_env="SystemRoot=$VOICE_WINDOWS_SYSTEM_ROOT"
diff --git a/third_party/voice/opus-toolchain.cmake b/third_party/voice/opus-toolchain.cmake
index 25fb567cd0..c183c73753 100644
--- a/third_party/voice/opus-toolchain.cmake
+++ b/third_party/voice/opus-toolchain.cmake
@@ -11,4 +11,10 @@ else()
   set(CMAKE_SYSTEM_NAME Linux)
 endif()
 string(REGEX REPLACE "-.*" "" CMAKE_SYSTEM_PROCESSOR "$ENV{TARGET}")
+if("$ENV{TARGET}" STREQUAL "aarch64-pc-windows-msvc")
+  # NEON is guaranteed on Windows ARM64. Opus's optional runtime probe emits
+  # ARM32 instructions through MSVC's __emit, which clang-cl does not support.
+  set(OPUS_PRESUME_NEON ON CACHE BOOL "" FORCE)
+  set(OPUS_MAY_HAVE_NEON OFF CACHE BOOL "" FORCE)
+endif()
 # Compiler, SDK and linker inputs remain supplied by Bazel's target toolchain.
diff --git a/third_party/voice/sources.json b/third_party/voice/sources.json
index 3d10b9adac..5c368e3e81 100644
--- a/third_party/voice/sources.json
+++ b/third_party/voice/sources.json
@@ -33,12 +33,12 @@
     },
     {
       "name": "pcre2",
-      "version": "10.47",
+      "version": "10.48",
       "role": "native-library",
-      "archive": "pcre2-10.47.tar",
-      "root": "pcre2-10.47",
-      "url": "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.gz",
-      "sha256": "c08ae2388ef333e8403e670ad70c0a11f1eed021fd88308d7e02f596fcd9dc16",
+      "archive": "pcre2-10.48.tar",
+      "root": "pcre2-10.48",
+      "url": "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.48/pcre2-10.48.tar.gz",
+      "sha256": "ebcc25aadf2a51fa1fefa9b8bc9e7a79b3dae86870a0f1152a22e42befd46888",
       "provenance": "GitHub release asset digest"
     },
     {