diff --git a/.github/actions/setup-bazel-ci/action.yml b/.github/actions/setup-bazel-ci/action.yml
index 34bbd40b19..f7b1ffaa59 100644
--- a/.github/actions/setup-bazel-ci/action.yml
+++ b/.github/actions/setup-bazel-ci/action.yml
@@ -60,8 +60,15 @@ runs:
         # Use the shortest available drive to reduce argv/path length issues,
         # but avoid the drive root because some Windows test launchers mis-handle
         # MANIFEST paths there.
-        $bazelOutputUserRoot = if (Test-Path 'D:\') { 'D:\b' } else { 'C:\b' }
+        $hasDDrive = Test-Path 'D:\'
+        $bazelOutputUserRoot = if ($hasDDrive) { 'D:\b' } else { 'C:\b' }
+        $repoContentsCache = Join-Path $env:RUNNER_TEMP "bazel-repo-contents-cache-$env:GITHUB_RUN_ID-$env:GITHUB_JOB"
         "BAZEL_OUTPUT_USER_ROOT=$bazelOutputUserRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        "BAZEL_REPO_CONTENTS_CACHE=$repoContentsCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        if (-not $hasDDrive) {
+          $repositoryCache = Join-Path $env:USERPROFILE '.cache\bazel-repo-cache'
+          "BAZEL_REPOSITORY_CACHE=$repositoryCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        }
 
     - name: Enable Git long paths (Windows)
       if: runner.os == 'Windows'
diff --git a/.github/scripts/run-argument-comment-lint-bazel.sh b/.github/scripts/run-argument-comment-lint-bazel.sh
new file mode 100755
index 0000000000..63de5d487f
--- /dev/null
+++ b/.github/scripts/run-argument-comment-lint-bazel.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ci_config=ci-linux
+case "${RUNNER_OS:-}" in
+  macOS)
+    ci_config=ci-macos
+    ;;
+  Windows)
+    ci_config=ci-windows
+    ;;
+esac
+
+bazel_lint_args=("$@")
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  has_host_platform_override=0
+  for arg in "${bazel_lint_args[@]}"; do
+    if [[ "$arg" == --host_platform=* ]]; then
+      has_host_platform_override=1
+      break
+    fi
+  done
+
+  if [[ $has_host_platform_override -eq 0 ]]; then
+    # The nightly Windows lint toolchain is registered with an MSVC exec
+    # platform even though the lint target platform stays on `windows-gnullvm`.
+    # Override the host platform here so the exec-side helper binaries actually
+    # match the registered toolchain set.
+    bazel_lint_args+=("--host_platform=//:local_windows_msvc")
+  fi
+
+  # Native Windows lint runs need exec-side Rust helper binaries and proc-macros
+  # to use rust-lld instead of the C++ linker path. The default `none`
+  # preference resolves to `cc` when a cc_toolchain is present, which currently
+  # routes these exec actions through clang++ with an argument shape it cannot
+  # consume.
+  bazel_lint_args+=("--@rules_rust//rust/settings:toolchain_linker_preference=rust")
+fi
+
+bazel_startup_args=()
+if [[ -n "${BAZEL_OUTPUT_USER_ROOT:-}" ]]; then
+  bazel_startup_args+=("--output_user_root=${BAZEL_OUTPUT_USER_ROOT}")
+fi
+
+run_bazel() {
+  if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+    MSYS2_ARG_CONV_EXCL='*' bazel "$@"
+    return
+  fi
+
+  bazel "$@"
+}
+
+run_bazel_with_startup_args() {
+  if [[ ${#bazel_startup_args[@]} -gt 0 ]]; then
+    run_bazel "${bazel_startup_args[@]}" "$@"
+    return
+  fi
+
+  run_bazel "$@"
+}
+
+read_query_labels() {
+  local query="$1"
+  local query_stdout
+  local query_stderr
+  query_stdout="$(mktemp)"
+  query_stderr="$(mktemp)"
+
+  if ! run_bazel_with_startup_args \
+    --noexperimental_remote_repo_contents_cache \
+    query \
+    --keep_going \
+    --output=label \
+    "$query" >"$query_stdout" 2>"$query_stderr"; then
+    cat "$query_stderr" >&2
+    rm -f "$query_stdout" "$query_stderr"
+    exit 1
+  fi
+
+  cat "$query_stdout"
+  rm -f "$query_stdout" "$query_stderr"
+}
+
+final_build_targets=(//codex-rs/...)
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  # Bazel's local Windows platform currently lacks a default test toolchain for
+  # `rust_test`, so target the concrete Rust crate rules directly. The lint
+  # aspect still walks their crate graph, which preserves incremental reuse for
+  # non-test code while avoiding non-Rust wrapper targets such as platform_data.
+  final_build_targets=()
+  while IFS= read -r label; do
+    [[ -n "$label" ]] || continue
+    final_build_targets+=("$label")
+  done < <(read_query_labels 'kind("rust_(library|binary|proc_macro) rule", //codex-rs/...)')
+
+  if [[ ${#final_build_targets[@]} -eq 0 ]]; then
+    echo "Failed to discover Windows Bazel lint targets." >&2
+    exit 1
+  fi
+fi
+
+./.github/scripts/run-bazel-ci.sh \
+  -- \
+  build \
+  "${bazel_lint_args[@]}" \
+  -- \
+  "${final_build_targets[@]}"
diff --git a/.github/scripts/run-bazel-ci.sh b/.github/scripts/run-bazel-ci.sh
index cf50135c2e..92abd0df2e 100755
--- a/.github/scripts/run-bazel-ci.sh
+++ b/.github/scripts/run-bazel-ci.sh
@@ -41,6 +41,15 @@ if [[ -n "${BAZEL_OUTPUT_USER_ROOT:-}" ]]; then
   bazel_startup_args+=("--output_user_root=${BAZEL_OUTPUT_USER_ROOT}")
 fi
 
+run_bazel() {
+  if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+    MSYS2_ARG_CONV_EXCL='*' bazel "$@"
+    return
+  fi
+
+  bazel "$@"
+}
+
 ci_config=ci-linux
 case "${RUNNER_OS:-}" in
   macOS)
@@ -60,7 +69,7 @@ print_bazel_test_log_tails() {
     bazel_info_cmd+=("${bazel_startup_args[@]}")
   fi
 
-  testlogs_dir="$("${bazel_info_cmd[@]}" info bazel-testlogs 2>/dev/null || echo bazel-testlogs)"
+  testlogs_dir="$(run_bazel "${bazel_info_cmd[@]:1}" info bazel-testlogs 2>/dev/null || echo bazel-testlogs)"
 
   local failed_targets=()
   while IFS= read -r target; do
@@ -126,6 +135,17 @@ if [[ $remote_download_toplevel -eq 1 ]]; then
   post_config_bazel_args+=(--remote_download_toplevel)
 fi
 
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  # Windows self-hosted runners can run multiple Bazel jobs concurrently. Give
+  # each job its own repo contents cache so they do not fight over the shared
+  # path configured in `ci-windows`.
+  post_config_bazel_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  post_config_bazel_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+
 bazel_console_log="$(mktemp)"
 trap 'rm -f "$bazel_console_log"' EXIT
 
@@ -149,7 +169,7 @@ if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
     bazel_run_args+=("${post_config_bazel_args[@]}")
   fi
   set +e
-  "${bazel_cmd[@]}" \
+  run_bazel "${bazel_cmd[@]:1}" \
     --noexperimental_remote_repo_contents_cache \
     "${bazel_run_args[@]}" \
     -- \
@@ -184,7 +204,7 @@ else
     bazel_run_args+=("${post_config_bazel_args[@]}")
   fi
   set +e
-  "${bazel_cmd[@]}" \
+  run_bazel "${bazel_cmd[@]:1}" \
     --noexperimental_remote_repo_contents_cache \
     "${bazel_run_args[@]}" \
     -- \
diff --git a/.github/workflows/rust-ci-full.yml b/.github/workflows/rust-ci-full.yml
index a09c7fd433..de9734f0e5 100644
--- a/.github/workflows/rust-ci-full.yml
+++ b/.github/workflows/rust-ci-full.yml
@@ -99,35 +99,27 @@ jobs:
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - name: Install nightly argument-comment-lint toolchain
-        if: ${{ runner.os == 'Windows' }}
-        shell: bash
-        run: |
-          rustup toolchain install nightly-2025-09-18 \
-            --profile minimal \
-            --component llvm-tools-preview \
-            --component rustc-dev \
-            --component rust-src \
-            --no-self-update
-          rustup default nightly-2025-09-18
       - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os != 'Windows' }}
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run-bazel-ci.sh \
-            -- \
-            build \
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
             --config=argument-comment-lint \
             --keep_going \
-            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
-            -- \
-            //codex-rs/...
-      - name: Run argument comment lint on codex-rs via packaged wrapper
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+      - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os == 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
+            --config=argument-comment-lint \
+            --platforms=//:local_windows \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
 
   # --- CI to validate on different os/targets --------------------------------
   lint_build:
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index a655b3071e..fde5075a39 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -159,35 +159,27 @@ jobs:
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - name: Install nightly argument-comment-lint toolchain
-        if: ${{ runner.os == 'Windows' }}
-        shell: bash
-        run: |
-          rustup toolchain install nightly-2025-09-18 \
-            --profile minimal \
-            --component llvm-tools-preview \
-            --component rustc-dev \
-            --component rust-src \
-            --no-self-update
-          rustup default nightly-2025-09-18
       - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os != 'Windows' }}
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run-bazel-ci.sh \
-            -- \
-            build \
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
             --config=argument-comment-lint \
             --keep_going \
-            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
-            -- \
-            //codex-rs/...
-      - name: Run argument comment lint on codex-rs via packaged wrapper
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+      - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os == 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
+            --config=argument-comment-lint \
+            --platforms=//:local_windows \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
 
   # --- Gatherer job that you mark as the ONLY required status -----------------
   results:
diff --git a/BUILD.bazel b/BUILD.bazel
index 0be4b711e6..3f59ff1160 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -17,12 +17,19 @@ platform(
 platform(
     name = "local_windows",
     constraint_values = [
-        # We just need to pick one of the ABIs. Do the same one we target.
         "@rules_rs//rs/experimental/platforms/constraints:windows_gnullvm",
     ],
     parents = ["@platforms//host"],
 )
 
+platform(
+    name = "local_windows_msvc",
+    constraint_values = [
+        "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
+    ],
+    parents = ["@platforms//host"],
+)
+
 alias(
     name = "rbe",
     actual = "@rbe_platform",
diff --git a/MODULE.bazel b/MODULE.bazel
index e71f92ca77..3494f4f0a0 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -82,6 +82,11 @@ rules_rust = use_extension("@rules_rs//rs/experimental:rules_rust.bzl", "rules_r
 rules_rust.patch(
     patches = [
         "//patches:rules_rust_windows_gnullvm_build_script.patch",
+        "//patches:rules_rust_windows_bootstrap_process_wrapper_linker.patch",
+        "//patches:rules_rust_windows_msvc_direct_link_args.patch",
+        "//patches:rules_rust_windows_exec_bin_target.patch",
+        "//patches:rules_rust_windows_exec_std.patch",
+        "//patches:rules_rust_repository_set_exec_constraints.patch",
     ],
     strip = 1,
 )
@@ -96,6 +101,34 @@ nightly_rust.toolchain(
     dev_components = True,
     edition = "2024",
 )
+# Keep Windows exec tools on MSVC so Bazel helper binaries link correctly, but
+# lint crate targets as `windows-gnullvm` to preserve the repo's actual cfgs.
+nightly_rust.repository_set(
+    name = "rust_windows_x86_64",
+    edition = "2024",
+    exec_triple = "x86_64-pc-windows-msvc",
+    exec_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
+    ],
+    target_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
+    ],
+    target_triple = "x86_64-pc-windows-msvc",
+    versions = ["nightly/2025-09-18"],
+)
+nightly_rust.repository_set(
+    name = "rust_windows_x86_64",
+    target_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_gnullvm",
+    ],
+    target_triple = "x86_64-pc-windows-gnullvm",
+)
 use_repo(nightly_rust, "rust_toolchains")
 
 toolchains = use_extension("@rules_rs//rs/experimental/toolchains:module_extension.bzl", "toolchains")
diff --git a/codex-rs/core/src/shell_snapshot_tests.rs b/codex-rs/core/src/shell_snapshot_tests.rs
index 90288300ff..ff700ff7a6 100644
--- a/codex-rs/core/src/shell_snapshot_tests.rs
+++ b/codex-rs/core/src/shell_snapshot_tests.rs
@@ -313,9 +313,15 @@ async fn timed_out_snapshot_shell_is_terminated() -> Result<()> {
         shell_snapshot: crate::shell::empty_shell_snapshot_receiver(),
     };
 
-    let err = run_script_with_timeout(&shell, &script, Duration::from_secs(1), true, dir.path())
-        .await
-        .expect_err("snapshot shell should time out");
+    let err = run_script_with_timeout(
+        &shell,
+        &script,
+        Duration::from_secs(1),
+        /*use_login_shell*/ true,
+        dir.path(),
+    )
+    .await
+    .expect_err("snapshot shell should time out");
     assert!(
         err.to_string().contains("timed out"),
         "expected timeout error, got {err:?}"
diff --git a/codex-rs/linux-sandbox/src/landlock.rs b/codex-rs/linux-sandbox/src/landlock.rs
index 307f956a4d..9a0e2c100c 100644
--- a/codex-rs/linux-sandbox/src/landlock.rs
+++ b/codex-rs/linux-sandbox/src/landlock.rs
@@ -274,7 +274,10 @@ mod tests {
     #[test]
     fn managed_network_enforces_seccomp_even_for_full_network_policy() {
         assert_eq!(
-            should_install_network_seccomp(NetworkSandboxPolicy::Enabled, true),
+            should_install_network_seccomp(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ true,
+            ),
             true
         );
     }
@@ -282,7 +285,10 @@ mod tests {
     #[test]
     fn full_network_policy_without_managed_network_skips_seccomp() {
         assert_eq!(
-            should_install_network_seccomp(NetworkSandboxPolicy::Enabled, false),
+            should_install_network_seccomp(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ false,
+            ),
             false
         );
     }
@@ -291,18 +297,22 @@ mod tests {
     fn restricted_network_policy_always_installs_seccomp() {
         assert!(should_install_network_seccomp(
             NetworkSandboxPolicy::Restricted,
-            false
+            /*allow_network_for_proxy*/ false,
         ));
         assert!(should_install_network_seccomp(
             NetworkSandboxPolicy::Restricted,
-            true
+            /*allow_network_for_proxy*/ true,
         ));
     }
 
     #[test]
     fn managed_proxy_routes_use_proxy_routed_seccomp_mode() {
         assert_eq!(
-            network_seccomp_mode(NetworkSandboxPolicy::Enabled, true, true),
+            network_seccomp_mode(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ true,
+                /*proxy_routed_network*/ true,
+            ),
             Some(NetworkSeccompMode::ProxyRouted)
         );
     }
@@ -310,7 +320,11 @@ mod tests {
     #[test]
     fn restricted_network_without_proxy_routing_uses_restricted_mode() {
         assert_eq!(
-            network_seccomp_mode(NetworkSandboxPolicy::Restricted, false, false),
+            network_seccomp_mode(
+                NetworkSandboxPolicy::Restricted,
+                /*allow_network_for_proxy*/ false,
+                /*proxy_routed_network*/ false,
+            ),
             Some(NetworkSeccompMode::Restricted)
         );
     }
@@ -318,7 +332,11 @@ mod tests {
     #[test]
     fn full_network_without_managed_proxy_skips_network_seccomp_mode() {
         assert_eq!(
-            network_seccomp_mode(NetworkSandboxPolicy::Enabled, false, false),
+            network_seccomp_mode(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ false,
+                /*proxy_routed_network*/ false,
+            ),
             None
         );
     }
diff --git a/codex-rs/linux-sandbox/src/proxy_routing.rs b/codex-rs/linux-sandbox/src/proxy_routing.rs
index f57472c8a1..07e1893ee3 100644
--- a/codex-rs/linux-sandbox/src/proxy_routing.rs
+++ b/codex-rs/linux-sandbox/src/proxy_routing.rs
@@ -718,7 +718,8 @@ mod tests {
     #[test]
     fn rewrites_proxy_url_to_local_loopback_port() {
         let rewritten =
-            rewrite_proxy_env_value("socks5h://127.0.0.1:8081", 43210).expect("rewritten value");
+            rewrite_proxy_env_value("socks5h://127.0.0.1:8081", /*local_port*/ 43210)
+                .expect("rewritten value");
         assert_eq!(rewritten, "socks5h://127.0.0.1:43210");
     }
 
diff --git a/patches/BUILD.bazel b/patches/BUILD.bazel
index 8d4acbbb91..56c857e31f 100644
--- a/patches/BUILD.bazel
+++ b/patches/BUILD.bazel
@@ -2,6 +2,11 @@ exports_files([
     "abseil_windows_gnullvm_thread_identity.patch",
     "aws-lc-sys_memcmp_check.patch",
     "llvm_windows_symlink_extract.patch",
+    "rules_rust_windows_bootstrap_process_wrapper_linker.patch",
+    "rules_rust_windows_exec_bin_target.patch",
+    "rules_rust_windows_exec_std.patch",
+    "rules_rust_repository_set_exec_constraints.patch",
+    "rules_rust_windows_msvc_direct_link_args.patch",
     "rules_rust_windows_gnullvm_build_script.patch",
     "rules_rs_windows_gnullvm_exec.patch",
     "rusty_v8_prebuilt_out_dir.patch",
diff --git a/patches/rules_rust_repository_set_exec_constraints.patch b/patches/rules_rust_repository_set_exec_constraints.patch
new file mode 100644
index 0000000000..31afae4f7a
--- /dev/null
+++ b/patches/rules_rust_repository_set_exec_constraints.patch
@@ -0,0 +1,26 @@
+# What: let `rules_rust` repository_set entries specify an explicit exec-platform
+# constraint set.
+# Why: codex needs Windows nightly lint toolchains to run helper binaries on an
+# MSVC exec platform while still targeting `windows-gnullvm` crates.
+
+diff --git a/rust/extensions.bzl b/rust/extensions.bzl
+--- a/rust/extensions.bzl
++++ b/rust/extensions.bzl
+@@ -52,6 +52,7 @@ def _rust_impl(module_ctx):
+                 "allocator_library": repository_set.allocator_library,
+                 "dev_components": repository_set.dev_components,
+                 "edition": repository_set.edition,
++                "exec_compatible_with": [str(v) for v in repository_set.exec_compatible_with] if repository_set.exec_compatible_with else None,
+                 "exec_triple": repository_set.exec_triple,
+                 "extra_target_triples": {repository_set.target_triple: [str(v) for v in repository_set.target_compatible_with]},
+                 "name": repository_set.name,
+@@ -166,6 +167,9 @@ _COMMON_TAG_KWARGS = {
+ 
+ _RUST_REPOSITORY_SET_TAG_ATTRS = {
++    "exec_compatible_with": attr.label_list(
++        doc = "Execution platform constraints for this repository_set.",
++    ),
+     "exec_triple": attr.string(
+         doc = "Exec triple for this repository_set.",
+     ),
+     "name": attr.string(
diff --git a/patches/rules_rust_windows_bootstrap_process_wrapper_linker.patch b/patches/rules_rust_windows_bootstrap_process_wrapper_linker.patch
new file mode 100644
index 0000000000..9a978b8be6
--- /dev/null
+++ b/patches/rules_rust_windows_bootstrap_process_wrapper_linker.patch
@@ -0,0 +1,23 @@
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -472,7 +472,19 @@
+         )
+         ld_is_direct_driver = False
+ 
+-    if not ld or toolchain.linker_preference == "rust":
++    # The bootstrap process wrapper is built without the normal rules_rust
++    # process wrapper. On Windows nightly toolchains that expose rust-lld, the
++    # C++ toolchain path currently resolves to clang++ while still emitting
++    # MSVC-style arguments, so prefer rust-lld for this one bootstrap binary
++    # instead of switching all Rust actions over.
++    use_bootstrap_rust_linker = (
++        toolchain.target_os.startswith("windows") and
++        toolchain.linker != None and
++        hasattr(ctx.executable, "_bootstrap_process_wrapper") and
++        not ctx.executable._process_wrapper
++    )
++
++    if not ld or toolchain.linker_preference == "rust" or use_bootstrap_rust_linker:
+         ld = toolchain.linker.path
+         ld_is_direct_driver = toolchain.linker_type == "direct"
+ 
diff --git a/patches/rules_rust_windows_exec_bin_target.patch b/patches/rules_rust_windows_exec_bin_target.patch
new file mode 100644
index 0000000000..e4cf306dff
--- /dev/null
+++ b/patches/rules_rust_windows_exec_bin_target.patch
@@ -0,0 +1,71 @@
+# What: compile exec-side Rust binaries against the exec Windows triple instead
+# of the lint target triple.
+# Why: Windows native argument-comment-lint keeps the repo target platform on
+# `windows-gnullvm` to preserve cfg coverage, but exec-side helper binaries
+# (build.rs, runners, bootstrap tools) must link as host tools. With
+# `toolchain_linker_preference=rust`, rules_rust was still feeding those exec
+# binaries the `windows-gnullvm` target/std path, which broke linking under the
+# native Bazel lint lane.
+
+diff --git a/rust/private/rustc.bzl b/rust/private/rustc.bzl
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -129,6 +129,20 @@
+     build_setting = config.bool(flag = True),
+ )
+ 
+-def _get_rustc_env(attr, toolchain, crate_name):
++def _effective_target_arch(toolchain, use_exec_target):
++    return toolchain.exec_triple.arch if use_exec_target else toolchain.target_arch
++
++def _effective_target_os(toolchain, use_exec_target):
++    return toolchain.exec_triple.system if use_exec_target else toolchain.target_os
++
++def _effective_target_flag_value(toolchain, use_exec_target):
++    return toolchain.exec_triple.str if use_exec_target else toolchain.target_flag_value
++
++def _effective_rust_std_paths(toolchain, use_exec_target):
++    if use_exec_target:
++        return ["{}/lib/rustlib/{}/lib".format(toolchain.sysroot, toolchain.exec_triple.str)]
++    return toolchain.rust_std_paths
++
++def _get_rustc_env(attr, toolchain, crate_name, use_exec_target = False):
+     """Gathers rustc environment variables
+ 
+@@ -147,6 +161,6 @@
+ 
+     result = {
+-        "CARGO_CFG_TARGET_ARCH": "" if toolchain.target_arch == None else toolchain.target_arch,
+-        "CARGO_CFG_TARGET_OS": "" if toolchain.target_os == None else toolchain.target_os,
++        "CARGO_CFG_TARGET_ARCH": "" if _effective_target_arch(toolchain, use_exec_target) == None else _effective_target_arch(toolchain, use_exec_target),
++        "CARGO_CFG_TARGET_OS": "" if _effective_target_os(toolchain, use_exec_target) == None else _effective_target_os(toolchain, use_exec_target),
+         "CARGO_CRATE_NAME": crate_name,
+         "CARGO_PKG_AUTHORS": "",
+@@ -997,9 +1011,11 @@
+     if build_metadata and not use_json_output:
+         fail("build_metadata requires parse_json_output")
+ 
++    use_exec_target = is_exec_configuration(ctx) and crate_info.type == "bin"
++
+     output_dir = getattr(crate_info.output, "dirname", None)
+     linker_script = getattr(file, "linker_script", None)
+ 
+-    env = _get_rustc_env(attr, toolchain, crate_info.name)
++    env = _get_rustc_env(attr, toolchain, crate_info.name, use_exec_target)
+ 
+     # Wrapper args first
+@@ -1138,5 +1154,5 @@
+     if error_format != "json":
+         # Color is not compatible with json output.
+         rustc_flags.add("--color=always")
+-    rustc_flags.add(toolchain.target_flag_value, format = "--target=%s")
++    rustc_flags.add(_effective_target_flag_value(toolchain, use_exec_target), format = "--target=%s")
+     if hasattr(attr, "crate_features"):
+@@ -1144,6 +1160,6 @@
+     if linker_script:
+         rustc_flags.add(linker_script, format = "--codegen=link-arg=-T%s")
+ 
+     # Tell Rustc where to find the standard library (or libcore)
+-    rustc_flags.add_all(toolchain.rust_std_paths, before_each = "-L", format_each = "%s")
++    rustc_flags.add_all(_effective_rust_std_paths(toolchain, use_exec_target), before_each = "-L", format_each = "%s")
+     rustc_flags.add_all(rust_flags, map_each = map_flag)
diff --git a/patches/rules_rust_windows_exec_std.patch b/patches/rules_rust_windows_exec_std.patch
new file mode 100644
index 0000000000..78c15f90a2
--- /dev/null
+++ b/patches/rules_rust_windows_exec_std.patch
@@ -0,0 +1,164 @@
+# What: expose an exec-side Rust standard library alongside the target stdlib.
+# Why: mixed Windows toolchains compile repo crates for `windows-gnullvm`, but
+# exec-side helper binaries (build.rs, runners) may need the host MSVC stdlib.
+# The toolchain sysroot must therefore carry both stdlib trees so rustc can
+# resolve the correct one for each `--target`.
+
+diff --git a/rust/toolchain.bzl b/rust/toolchain.bzl
+--- a/rust/toolchain.bzl
++++ b/rust/toolchain.bzl
+@@ -209,6 +209,7 @@ def _generate_sysroot(
+         clippy = None,
+         cargo_clippy = None,
+         llvm_tools = None,
++        exec_rust_std = None,
+         rust_std = None,
+         rustfmt = None,
+         linker = None):
+@@ -312,7 +313,15 @@ def _generate_sysroot(
+ 
+         # Made available to support $(location) expansion in stdlib_linkflags and extra_rustc_flags.
+         transitive_file_sets.append(depset(ctx.files.rust_std))
++
++    sysroot_exec_rust_std = None
++    if exec_rust_std:
++        sysroot_exec_rust_std = _symlink_sysroot_tree(ctx, name, exec_rust_std)
++        transitive_file_sets.extend([sysroot_exec_rust_std])
+ 
++        # Made available to support $(location) expansion in extra_exec_rustc_flags.
++        transitive_file_sets.append(depset(ctx.files.exec_rust_std))
++
+     # Declare a file in the root of the sysroot to make locating the sysroot easy
+     sysroot_anchor = ctx.actions.declare_file("{}/rust.sysroot".format(name))
+     ctx.actions.write(
+@@ -323,6 +332,7 @@ def _generate_sysroot(
+             "cargo-clippy: {}".format(cargo_clippy),
+             "linker: {}".format(linker),
+             "llvm_tools: {}".format(llvm_tools),
++            "exec_rust_std: {}".format(exec_rust_std),
+             "rust_std: {}".format(rust_std),
+             "rustc_lib: {}".format(rustc_lib),
+             "rustc: {}".format(rustc),
+@@ -340,6 +350,7 @@ def _generate_sysroot(
+         cargo_clippy = sysroot_cargo_clippy,
+         clippy = sysroot_clippy,
+         linker = sysroot_linker,
++        exec_rust_std = sysroot_exec_rust_std,
+         rust_std = sysroot_rust_std,
+         rustc = sysroot_rustc,
+         rustc_lib = sysroot_rustc_lib,
+@@ -410,12 +421,14 @@ def _rust_toolchain_impl(ctx):
+         )
+ 
+     rust_std = ctx.attr.rust_std
++    exec_rust_std = ctx.attr.exec_rust_std if ctx.attr.exec_rust_std else rust_std
+ 
+     sysroot = _generate_sysroot(
+         ctx = ctx,
+         rustc = ctx.file.rustc,
+         rustdoc = ctx.file.rust_doc,
+         rustc_lib = ctx.attr.rustc_lib,
++        exec_rust_std = exec_rust_std,
+         rust_std = rust_std,
+         rustfmt = ctx.file.rustfmt,
+         clippy = ctx.file.clippy_driver,
+@@ -452,7 +465,7 @@ def _rust_toolchain_impl(ctx):
+ 
+     expanded_stdlib_linkflags = _expand_flags(ctx, "stdlib_linkflags", rust_std[rust_common.stdlib_info].srcs, make_variables)
+     expanded_extra_rustc_flags = _expand_flags(ctx, "extra_rustc_flags", rust_std[rust_common.stdlib_info].srcs, make_variables)
+-    expanded_extra_exec_rustc_flags = _expand_flags(ctx, "extra_exec_rustc_flags", rust_std[rust_common.stdlib_info].srcs, make_variables)
++    expanded_extra_exec_rustc_flags = _expand_flags(ctx, "extra_exec_rustc_flags", exec_rust_std[rust_common.stdlib_info].srcs, make_variables)
+ 
+     linking_context = cc_common.create_linking_context(
+         linker_inputs = depset([
+@@ -793,6 +806,10 @@ rust_toolchain = rule(
+             doc = "The Rust standard library.",
+             mandatory = True,
+         ),
++        "exec_rust_std": attr.label(
++            doc = "Optional Rust standard library for exec-configuration Rust tools. Defaults to rust_std.",
++            mandatory = False,
++        ),
+         "rustc": attr.label(
+             doc = "The location of the `rustc` binary. Can be a direct source or a filegroup containing one item.",
+             allow_single_file = True,
+diff --git a/rust/private/repository_utils.bzl b/rust/private/repository_utils.bzl
+--- a/rust/private/repository_utils.bzl
++++ b/rust/private/repository_utils.bzl
+@@ -341,6 +341,7 @@ rust_toolchain(
+     name = "{toolchain_name}",
+     rust_doc = "//:rustdoc",
+     rust_std = "//:rust_std-{target_triple}",
++    exec_rust_std = {exec_rust_std_label},
+     rustc = "//:rustc",
+     linker = {linker_label},
+     linker_type = {linker_type},
+@@ -384,6 +385,7 @@ def BUILD_for_rust_toolchain(
+         include_llvm_tools,
+         include_linker,
+         include_objcopy = False,
++        exec_rust_std_label = None,
+         stdlib_linkflags = None,
+         extra_rustc_flags = None,
+         extra_exec_rustc_flags = None,
+@@ -405,6 +407,7 @@ def BUILD_for_rust_toolchain(
+         include_llvm_tools (bool): Whether llvm-tools are present in the toolchain.
+         include_linker (bool): Whether a linker is available in the toolchain.
+         include_objcopy (bool): Whether rust-objcopy is available in the toolchain.
++        exec_rust_std_label (str, optional): Label for an exec-side stdlib when it differs from rust_std.
+         stdlib_linkflags (list, optional): Overridden flags needed for linking to rust
+                                            stdlib, akin to BAZEL_LINKLIBS. Defaults to
+                                            None.
+@@ -453,6 +456,7 @@ def BUILD_for_rust_toolchain(
+         staticlib_ext = system_to_staticlib_ext(target_triple.system),
+         dylib_ext = system_to_dylib_ext(target_triple.system),
+         allocator_library = repr(allocator_library_label),
++        exec_rust_std_label = repr(exec_rust_std_label),
+         global_allocator_library = repr(global_allocator_library_label),
+         stdlib_linkflags = stdlib_linkflags,
+         default_edition = default_edition,
+diff --git a/rust/private/rustc.bzl b/rust/private/rustc.bzl
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -1011,7 +1011,10 @@ def construct_arguments(
+     if build_metadata and not use_json_output:
+         fail("build_metadata requires parse_json_output")
+ 
+-    use_exec_target = is_exec_configuration(ctx) and crate_info.type == "bin"
++    # Exec-configuration crates (build scripts, proc-macros, and their
++    # dependencies) must all target the exec triple so they can link against
++    # each other and the exec-side standard library.
++    use_exec_target = is_exec_configuration(ctx)
+ 
+     output_dir = getattr(crate_info.output, "dirname", None)
+     linker_script = getattr(file, "linker_script", None)
+diff --git a/rust/repositories.bzl b/rust/repositories.bzl
+--- a/rust/repositories.bzl
++++ b/rust/repositories.bzl
+@@ -536,6 +536,18 @@ def _rust_toolchain_tools_repository_impl(ctx):
+     build_components.append(rust_stdlib_content)
+     sha256s.update(rust_stdlib_sha256)
+ 
++    exec_rust_std_label = None
++    if exec_triple.str != target_triple.str:
++        exec_rust_stdlib_content, exec_rust_stdlib_sha256 = load_rust_stdlib(
++            ctx = ctx,
++            target_triple = exec_triple,
++            version = version,
++            iso_date = iso_date,
++        )
++        build_components.append(exec_rust_stdlib_content)
++        sha256s.update(exec_rust_stdlib_sha256)
++        exec_rust_std_label = "//:rust_std-{}".format(exec_triple.str)
++
+     stdlib_linkflags = None
+     if "BAZEL_RUST_STDLIB_LINKFLAGS" in ctx.os.environ:
+         stdlib_linkflags = ctx.os.environ["BAZEL_RUST_STDLIB_LINKFLAGS"].split(":")
+@@ -552,6 +564,7 @@ def _rust_toolchain_tools_repository_impl(ctx):
+         include_llvm_tools = include_llvm_tools,
+         include_linker = include_linker,
+         include_objcopy = include_objcopy,
++        exec_rust_std_label = exec_rust_std_label,
+         extra_rustc_flags = ctx.attr.extra_rustc_flags,
+         extra_exec_rustc_flags = ctx.attr.extra_exec_rustc_flags,
+         opt_level = ctx.attr.opt_level if ctx.attr.opt_level else None,
diff --git a/patches/rules_rust_windows_msvc_direct_link_args.patch b/patches/rules_rust_windows_msvc_direct_link_args.patch
new file mode 100644
index 0000000000..2f04f8ca89
--- /dev/null
+++ b/patches/rules_rust_windows_msvc_direct_link_args.patch
@@ -0,0 +1,64 @@
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -2305,7 +2305,7 @@
+         return crate.metadata.dirname
+     return crate.output.dirname
+ 
+-def _portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, for_windows = False, for_darwin = False, flavor_msvc = False):
++def _portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, for_windows = False, for_darwin = False, flavor_msvc = False, use_direct_driver = False):
+     artifact = get_preferred_artifact(lib, use_pic)
+     if ambiguous_libs and artifact.path in ambiguous_libs:
+         artifact = ambiguous_libs[artifact.path]
+@@ -2344,6 +2344,11 @@
+             artifact.basename.startswith("test-") or artifact.basename.startswith("std-")
+         ):
+             return [] if for_darwin else ["-lstatic=%s" % get_lib_name(artifact)]
++
++        if for_windows and use_direct_driver and not artifact.basename.endswith(".lib"):
++            return [
++                "-Clink-arg={}".format(artifact.path),
++            ]
+ 
+         if flavor_msvc:
+             return [
+@@ -2381,7 +2386,7 @@
+                 ])
+         elif include_link_flags:
+             get_lib_name = get_lib_name_for_windows if flavor_msvc else get_lib_name_default
+-            ret.extend(_portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, flavor_msvc = flavor_msvc))
++            ret.extend(_portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, flavor_msvc = flavor_msvc, use_direct_driver = use_direct_driver))
+ 
+     # Windows toolchains can inherit POSIX defaults like -pthread from C deps,
+     # which fails to link with the MinGW/LLD toolchain. Drop them here.
+@@ -2558,17 +2563,25 @@
+         else:
+             # For all other crate types we want to link C++ runtime library statically
+             # (for example libstdc++.a or libc++.a).
++            runtime_libs = cc_toolchain.static_runtime_lib(feature_configuration = feature_configuration)
+             args.add_all(
+-                cc_toolchain.static_runtime_lib(feature_configuration = feature_configuration),
++                runtime_libs,
+                 map_each = _get_dirname,
+                 format_each = "-Lnative=%s",
+             )
+             if include_link_flags:
+-                args.add_all(
+-                    cc_toolchain.static_runtime_lib(feature_configuration = feature_configuration),
+-                    map_each = get_lib_name,
+-                    format_each = "-lstatic=%s",
+-                )
++                if toolchain.target_os == "windows" and use_direct_link_driver:
++                    for runtime_lib in runtime_libs.to_list():
++                        if runtime_lib.basename.endswith(".lib"):
++                            args.add(get_lib_name(runtime_lib), format = "-lstatic=%s")
++                        else:
++                            args.add(runtime_lib.path, format = "--codegen=link-arg=%s")
++                else:
++                    args.add_all(
++                        runtime_libs,
++                        map_each = get_lib_name,
++                        format_each = "-lstatic=%s",
++                    )
+ 
+ def _get_dirname(file):
+     """A helper function for `_add_native_link_flags`.