diff --git a/MODULE.bazel b/MODULE.bazel
index 1ffbfa19e7..5ae6f2b161 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -4,6 +4,9 @@ bazel_dep(name = "bazel_lib", version = "3.2.2")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 
+bazel_lib_toolchains = use_extension("@bazel_lib//lib:extensions.bzl", "toolchains")
+use_repo(bazel_lib_toolchains, "coreutils_toolchains")
+
 # Expose rules_rs's existing dependency for the openssl-sys replacement's SBOM.
 bazel_dep(name = "package_metadata", version = "0.0.7")
 
diff --git a/codex-rs/bwrap/BUILD.bazel b/codex-rs/bwrap/BUILD.bazel
index cc27df89a1..8b9c0de80b 100644
--- a/codex-rs/bwrap/BUILD.bazel
+++ b/codex-rs/bwrap/BUILD.bazel
@@ -32,12 +32,11 @@ genrule(
     srcs = [":bwrap"],
     outs = ["bwrap.sha256.env"],
     cmd = " && ".join([
-        '$(execpath @bazel_tools//tools/build_defs/hash:sha256) $(execpath :bwrap) "$@"',
-        'digest=$$(<"$@")',
-        'printf "CODEX_BWRAP_SHA256=%s\\n" "$$digest" > "$@"',
+        'digest=$$("$(COREUTILS_BIN)" sha256sum < "$<")',
+        'printf "CODEX_BWRAP_SHA256=%s\\n" "$${digest%% *}" > "$@"',
     ]),
     target_compatible_with = ["@platforms//os:linux"],
-    tools = ["@bazel_tools//tools/build_defs/hash:sha256"],
+    toolchains = ["@coreutils_toolchains//:resolved_toolchain"],
     visibility = ["//codex-rs/linux-sandbox:__pkg__"],
 )
 
diff --git a/third_party/voice/build_native.py b/third_party/voice/build_native.py
index 2bc7ce5a8e..74ae81e2ea 100644
--- a/third_party/voice/build_native.py
+++ b/third_party/voice/build_native.py
@@ -135,14 +135,12 @@ class NativeBuild:
         }
         if windows_inputs is not None:
             self.environment.pop("LIBPATH", None)
-        paths = [
-            str(self.tools / "bin"),
-            *(
-                []
-                if windows_inputs is not None
-                else [str(p.parent) for p in self.toolchain.values()]
-            ),
-        ]
+        paths = [str(self.tools / "bin")]
+        if not self.windows:
+            # GLib generators use /usr/bin/env python3 even when Meson runs under Bazel.
+            paths.append(str(Path(sys.executable).parent))
+        if windows_inputs is None:
+            paths.extend(str(p.parent) for p in self.toolchain.values())
         paths += (
             inherited_environment.get("PATH", "").split(os.pathsep)
             if self.windows
diff --git a/third_party/voice/test_build_native.py b/third_party/voice/test_build_native.py
index 9cd6703a3e..4219278247 100644
--- a/third_party/voice/test_build_native.py
+++ b/third_party/voice/test_build_native.py
@@ -85,6 +85,21 @@ class NativeBuildTests(unittest.TestCase):
             NativeBuild(self.args, self.environment)
         self.assertFalse(self.args.output.exists())
 
+    @unittest.skipIf(os.name == "nt", "Exercises a Unix generator shebang")
+    def test_generator_uses_the_recipe_interpreter(self):
+        python = self.root / "runtime" / "bin" / "python3"
+        python.parent.mkdir(parents=True)
+        python.symlink_to(sys.executable)
+        with patch("sys.executable", str(python)):
+            build = NativeBuild(self.args, self.environment)
+        generator = self.root / "generator"
+        generator.write_text(
+            "#!/usr/bin/env python3\nimport sys\nprint(sys.executable)\n"
+        )
+        generator.chmod(0o755)
+        result = subprocess.check_output([generator], env=build.environment, text=True)
+        self.assertEqual(result.strip(), str(python))
+
     @unittest.skipIf(os.name == "nt", "Exercises the Unix clang++ driver symlink")
     def test_bootstrap_links_cpp_runtime_through_compiler_symlink(self):
         tools = {name: shutil.which(name) for name in ("clang", "cmake", "make")}