diff --git a/MODULE.bazel b/MODULE.bazel
index 689e684..efa93bf 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -75,22 +75,21 @@
 # Currently supported version are listed here:
 # https://protobuf.dev/support/version-support/
 bazel_dep(name = "protobuf", version = "29.3")
-
-# Load musl toolchain Metropolis sysroot tarball into external repository.
-musl_sysroot_rule = use_repo_rule("//build/toolchain/musl-host-gcc:sysroot_repository.bzl", "musl_sysroot_rule")
-
-musl_sysroot_rule(
-    name = "musl_sysroot",
-    snapshot = "//build/toolchain/musl-host-gcc:sysroot.tar.xz",
+bazel_dep(name = "toolchain_cc_mngn")
+git_override(
+    module_name = "toolchain_cc_mngn",
+    commit = "6e241ef6ebcbdc630d332fa789a1b53b52c27771",
+    remote = "https://review.monogon.dev/toolchain_cc",
 )
 
-# Register our custom CC toolchains.
-register_toolchains("//build/toolchain/musl-host-gcc:musl_host_toolchain")
-
-register_toolchains("//build/toolchain/llvm-efi:efi_k8_toolchain")
-
 register_toolchains("//build/toolchain:host_cc_toolchain")
 
+register_toolchains("@toolchain_cc_mngn//linux_musl:linux_x86_64_linux_x86_64_musl_static")
+
+register_toolchains("@toolchain_cc_mngn//efi:linux_x86_64_efi_x86_64")
+
+register_toolchains("@toolchain_cc_mngn//efi:linux_x86_64_efi_aarch64")
+
 # Rust Toolchains
 register_toolchains("@rust_toolchains//:all")
 
diff --git a/build/platforms/linkmode/BUILD.bazel b/build/platforms/linkmode/BUILD.bazel
deleted file mode 100644
index f749e9d..0000000
--- a/build/platforms/linkmode/BUILD.bazel
+++ /dev/null
@@ -1,7 +0,0 @@
-load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
-
-bool_flag(
-    name = "static",
-    build_setting_default = False,
-    visibility = ["//visibility:public"],
-)
diff --git a/build/toolchain/BUILD.bazel b/build/toolchain/BUILD.bazel
index 75cd911..a1d2288 100644
--- a/build/toolchain/BUILD.bazel
+++ b/build/toolchain/BUILD.bazel
@@ -51,7 +51,7 @@
 
 config_setting(
     name = "is_dynamic",
-    flag_values = {"//build/platforms/linkmode:static": "False"},
+    flag_values = {"@toolchain_cc_mngn//buildmode:static": "False"},
 )
 
 toolchain(
diff --git a/build/toolchain/llvm-efi/BUILD.bazel b/build/toolchain/llvm-efi/BUILD.bazel
deleted file mode 100644
index 169a37f..0000000
--- a/build/toolchain/llvm-efi/BUILD.bazel
+++ /dev/null
@@ -1,47 +0,0 @@
-load("@rules_cc//cc:defs.bzl", "cc_toolchain")
-load(":cc_toolchain_config.bzl", "efi_k8_cc_toolchain_config")
-
-package(default_visibility = ["//visibility:public"])
-
-filegroup(name = "empty")
-
-filegroup(
-    name = "fltused",
-    srcs = ["fltused.o"],
-)
-
-filegroup(
-    name = "all",
-    srcs = [":fltused"],
-)
-
-cc_toolchain(
-    name = "efi_k8_cc_toolchain",
-    all_files = ":all",
-    ar_files = ":empty",
-    as_files = ":empty",
-    compiler_files = ":empty",
-    dwp_files = ":empty",
-    linker_files = ":fltused",
-    objcopy_files = ":empty",
-    strip_files = ":empty",
-    supports_param_files = 0,
-    toolchain_config = ":efi_k8_cc_toolchain_config",
-    toolchain_identifier = "efi-k8-toolchain",
-)
-
-efi_k8_cc_toolchain_config(name = "efi_k8_cc_toolchain_config")
-
-toolchain(
-    name = "efi_k8_toolchain",
-    exec_compatible_with = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:linux",
-    ],
-    target_compatible_with = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:uefi",
-    ],
-    toolchain = ":efi_k8_cc_toolchain",
-    toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
-)
diff --git a/build/toolchain/llvm-efi/README.md b/build/toolchain/llvm-efi/README.md
deleted file mode 100644
index 0360ec5..0000000
--- a/build/toolchain/llvm-efi/README.md
+++ /dev/null
@@ -1,27 +0,0 @@
-llvm-efi
-========
-
-llvm-efi is a Bazel cc toolchain that uses the sandbox sysroot LLVM/clang with flags targeting freestanding EFI.
-EFI headers are not shipped as part of the toolchain, but are available as a cc_library from `@gnuefi//:gnuefi`.
-
-Usage
------
-
-To use this toolchain explicitly while building a `cc_binary`, do:
-
-    bazel build --platforms=//build/platforms:efi_amd64 //foo/bar
-
-During an actual build however, the right toolchain should be selected using transitions
-or other configuration mechanisms.
-
-fltused
--------
-
-This is a special symbol emitted by MSVC-compatible compilers. In an EFI environment it can be ignored, but it needs to
-be defined. See fltused.c for more information on the symbol. Since we cannot build an object file with Bazel and
-building things for toolchains isn't a thing anyways, this file is prebuilt. If this ever needs to be rebuilt (which
-will probably never happen since there is only one static symbol in there) this can be done with the following clang
-invocation:
-
-    clang -target x86_64-unknown-windows -fno-ms-compatibility -fno-ms-extensions -ffreestanding -o fltused.o .o -c fltused.c
-   
diff --git a/build/toolchain/llvm-efi/cc_toolchain_config.bzl b/build/toolchain/llvm-efi/cc_toolchain_config.bzl
deleted file mode 100644
index f6de95d..0000000
--- a/build/toolchain/llvm-efi/cc_toolchain_config.bzl
+++ /dev/null
@@ -1,217 +0,0 @@
-load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
-load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool_path", "with_feature_set")
-
-all_compile_actions = [
-    ACTION_NAMES.c_compile,
-    ACTION_NAMES.cpp_compile,
-    ACTION_NAMES.linkstamp_compile,
-    ACTION_NAMES.assemble,
-    ACTION_NAMES.preprocess_assemble,
-    ACTION_NAMES.cpp_header_parsing,
-    ACTION_NAMES.cpp_module_compile,
-    ACTION_NAMES.cpp_module_codegen,
-    ACTION_NAMES.clif_match,
-    ACTION_NAMES.lto_backend,
-]
-
-all_cpp_compile_actions = [
-    ACTION_NAMES.cpp_compile,
-    ACTION_NAMES.linkstamp_compile,
-    ACTION_NAMES.cpp_header_parsing,
-    ACTION_NAMES.cpp_module_compile,
-    ACTION_NAMES.cpp_module_codegen,
-    ACTION_NAMES.clif_match,
-]
-
-preprocessor_compile_actions = [
-    ACTION_NAMES.c_compile,
-    ACTION_NAMES.cpp_compile,
-    ACTION_NAMES.linkstamp_compile,
-    ACTION_NAMES.preprocess_assemble,
-    ACTION_NAMES.cpp_header_parsing,
-    ACTION_NAMES.cpp_module_compile,
-    ACTION_NAMES.clif_match,
-]
-
-codegen_compile_actions = [
-    ACTION_NAMES.c_compile,
-    ACTION_NAMES.cpp_compile,
-    ACTION_NAMES.linkstamp_compile,
-    ACTION_NAMES.assemble,
-    ACTION_NAMES.preprocess_assemble,
-    ACTION_NAMES.cpp_module_codegen,
-    ACTION_NAMES.lto_backend,
-]
-
-all_link_actions = [
-    ACTION_NAMES.cpp_link_executable,
-    ACTION_NAMES.cpp_link_dynamic_library,
-    ACTION_NAMES.cpp_link_nodeps_dynamic_library,
-]
-
-lto_index_actions = [
-    ACTION_NAMES.lto_index_for_executable,
-    ACTION_NAMES.lto_index_for_dynamic_library,
-    ACTION_NAMES.lto_index_for_nodeps_dynamic_library,
-]
-
-# This defines a relatively minimal EFI toolchain based on host LLVM and no standard library or headers.
-def _efi_k8_cc_toolchain_impl(ctx):
-    default_compile_flags_feature = feature(
-        name = "default_compile_flags",
-        enabled = True,
-        flag_sets = [
-            flag_set(
-                actions = all_compile_actions,
-                flag_groups = ([
-                    flag_group(
-                        flags = ["-target", "x86_64-unknown-windows"],
-                    ),
-                ]),
-            ),
-            flag_set(
-                actions = all_compile_actions,
-                flag_groups = ([
-                    flag_group(
-                        flags = ["-g"],
-                    ),
-                ]),
-                with_features = [with_feature_set(features = ["dbg"])],
-            ),
-            flag_set(
-                actions = all_compile_actions,
-                flag_groups = ([
-                    flag_group(
-                        # Don't bother with O3, this is an EFI toolchain. It's unlikely to gain much performance here
-                        # and increases the risk of dangerous optimizations.
-                        flags = ["-O2", "-DNDEBUG"],
-                    ),
-                ]),
-                with_features = [with_feature_set(features = ["opt"])],
-            ),
-        ],
-    )
-
-    # "Hybrid" mode disables some MSVC C extensions (but keeps its ABI), but still identifies as MSVC.
-    # This is useful if code requires GNU extensions to work which are silently ignored in full MSVC mode.
-    # As EFI does not include Windows headers which depend on nonstandard C behavior this should be fine for most code.
-    # If this feature is disabled, the toolchain runs with MSVC C extensions fully enabled.
-    hybrid_gnu_msvc_feature = feature(
-        name = "hybrid_gnu_msvc",
-        enabled = True,
-        flag_sets = [
-            flag_set(
-                actions = all_compile_actions,
-                flag_groups = [
-                    flag_group(
-                        flags = ["-D_MSC_VER=1920", "-fno-ms-compatibility", "-fno-ms-extensions"],
-                    ),
-                ],
-            ),
-        ],
-    )
-
-    default_link_flags_feature = feature(
-        name = "default_link_flags",
-        enabled = True,
-        flag_sets = [
-            flag_set(
-                actions = all_link_actions + lto_index_actions,
-                flag_groups = ([
-                    flag_group(
-                        flags = [
-                            "--target=x86_64-unknown-windows",
-                            "-fuse-ld=lld",
-                            "-Wl,-entry:efi_main",
-                            "-Wl,-subsystem:efi_application",
-                            "-Wl,/BASE:0x0",
-                            "-Wl,/Brepro",
-                            "-nostdlib",
-                            "build/toolchain/llvm-efi/fltused.o",
-                        ],
-                    ),
-                ]),
-            ),
-        ],
-    )
-
-    lto_feature = feature(
-        name = "lto",
-        enabled = False,
-        flag_sets = [
-            flag_set(
-                actions = all_compile_actions + all_link_actions,
-                flag_groups = ([
-                    flag_group(
-                        flags = [
-                            "-flto",
-                        ],
-                    ),
-                ]),
-            ),
-        ],
-    )
-
-    tool_paths = [
-        tool_path(
-            name = "gcc",
-            path = "/usr/bin/clang",
-        ),
-        tool_path(
-            name = "ld",
-            path = "/usr/bin/lld-link",
-        ),
-        tool_path(
-            name = "ar",
-            path = "/usr/bin/llvm-ar",
-        ),
-        tool_path(
-            name = "cpp",
-            path = "/bin/false",
-        ),
-        tool_path(
-            name = "gcov",
-            path = "/bin/false",
-        ),
-        tool_path(
-            name = "nm",
-            path = "/usr/bin/llvm-nm",
-        ),
-        tool_path(
-            name = "objcopy",
-            # We can't use LLVM's objcopy until we pick up https://reviews.llvm.org/D106942
-            path = "/usr/bin/objcopy",
-        ),
-        tool_path(
-            name = "objdump",
-            path = "/usr/bin/llvm-objdump",
-        ),
-        tool_path(
-            name = "strip",
-            path = "/usr/bin/llvm-strip",
-        ),
-    ]
-
-    return cc_common.create_cc_toolchain_config_info(
-        ctx = ctx,
-        features = [default_link_flags_feature, default_compile_flags_feature, hybrid_gnu_msvc_feature, lto_feature],
-        # Needed for various compiler built-in headers and auxiliary data. No system libraries are being used.
-        cxx_builtin_include_directories = [
-            "/usr/lib/clang/18/include/",
-        ],
-        toolchain_identifier = "k8-toolchain",
-        host_system_name = "local",
-        target_system_name = "x86_64-efi",
-        target_cpu = "k8",
-        target_libc = "none",
-        compiler = "clang",
-        abi_version = "none",
-        abi_libc_version = "none",
-        tool_paths = tool_paths,
-    )
-
-efi_k8_cc_toolchain_config = rule(
-    implementation = _efi_k8_cc_toolchain_impl,
-    attrs = {},
-    provides = [CcToolchainConfigInfo],
-)
diff --git a/build/toolchain/llvm-efi/fltused.c b/build/toolchain/llvm-efi/fltused.c
deleted file mode 100644
index 6934b9e..0000000
--- a/build/toolchain/llvm-efi/fltused.c
+++ /dev/null
@@ -1,6 +0,0 @@
-// This is a marker symbol emitted by MSVC-ABI compatible compilers. Its presence indicates that the linked binary
-// contains instructions working with floating-point registers. Since we do not have a standard library which consumes
-// it we can just define it as zero.
-// See https://github.com/rust-lang/rust/issues/62785#issuecomment-531186089 for more discussion.
-// Since building static libraries is not possible with Bazel this is compiled and checked in.
-int _fltused __attribute__((weak)) = 0;
\ No newline at end of file
diff --git a/build/toolchain/llvm-efi/fltused.o b/build/toolchain/llvm-efi/fltused.o
deleted file mode 100644
index 68faed5..0000000
--- a/build/toolchain/llvm-efi/fltused.o
+++ /dev/null
Binary files differ
diff --git a/build/toolchain/musl-host-gcc/BUILD.bazel b/build/toolchain/musl-host-gcc/BUILD.bazel
deleted file mode 100644
index fd7e553..0000000
--- a/build/toolchain/musl-host-gcc/BUILD.bazel
+++ /dev/null
@@ -1,65 +0,0 @@
-load("@rules_cc//cc:defs.bzl", "cc_toolchain")
-load("//build/toolchain:cc_toolchain_config.bzl", "host_cc_toolchain_config")
-
-# This file defines //build/toolchain/musl-host-gcc:musl_host_toolchain.
-#
-# This is a C++ toolchain that uses GCC from the sandbox sysroot at hardcoded paths, with
-# a pre-built sysroot tarball that targets Metropolis nodes with musl and Linux
-# headers.  It's a superset of //build/toolchain:host_cc_toolchain.
-#
-# For more information, see README.md.
-
-cc_toolchain(
-    name = "musl_host_cc_k8_toolchain",
-    all_files = ":musl_toolchain_files",
-    ar_files = ":musl_toolchain_files",
-    as_files = ":musl_toolchain_files",
-    compiler_files = ":musl_toolchain_files",
-    dwp_files = ":musl_toolchain_files",
-    linker_files = ":musl_toolchain_files",
-    objcopy_files = ":musl_toolchain_files",
-    strip_files = ":musl_toolchain_files",
-    supports_param_files = 0,
-    toolchain_config = ":musl_host_cc_k8_toolchain_config",
-    toolchain_identifier = "host-musl-k8-toolchain",
-)
-
-host_cc_toolchain_config(
-    name = "musl_host_cc_k8_toolchain_config",
-    gcc = "gcc-wrapper.sh",
-    has_cpp = False,
-    host_includes = [],
-    is_glibc = False,
-    sysroot = package_relative_label("@musl_sysroot//:all").workspace_root,
-)
-
-filegroup(
-    name = "musl_toolchain_files",
-    srcs = [
-        ":gcc-wrapper.sh",
-        ":musl.spec",
-        "@musl_sysroot//:all",
-    ],
-)
-
-config_setting(
-    name = "is_static",
-    flag_values = {"//build/platforms/linkmode:static": "True"},
-)
-
-toolchain(
-    name = "musl_host_toolchain",
-    exec_compatible_with = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:linux",
-    ],
-    target_compatible_with = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:linux",
-    ],
-    target_settings = [
-        ":is_static",
-    ],
-    toolchain = ":musl_host_cc_k8_toolchain",
-    toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
-)
diff --git a/build/toolchain/musl-host-gcc/README.md b/build/toolchain/musl-host-gcc/README.md
deleted file mode 100644
index a5e9222..0000000
--- a/build/toolchain/musl-host-gcc/README.md
+++ /dev/null
@@ -1,45 +0,0 @@
-musl-host-gcc
-=============
-
-musl-host-gcc is a Bazel C++ toolchain that uses the sandbox sysroot gcc in combination with a pre-built musl, musl headers, and Linux headers.
-
-It is currently used to build the few C binaries we need on Metropolis nodes.
-
-At some point, this toolchain should be improved to directly consume a static compiler toolchain and sysroot, so we can eventually get rid of the sandbox (like Aspect's [gcc-toolchain](https://github.com/aspect-build/gcc-toolchain) is doing).
-
-Usage
------
-
-To use this toolchain explicitly while building a `cc_binary`, do:
-
-    bazel build --platforms=//build/platforms:linux_amd64_static //foo/bar
-
-During an actual build however, the right toolchain should be selected using transitions
-or other configuration mechanisms.
-
-Building Toolchain Sysroot Tarball
-----------------------------------
-
-The toolchain's musl/linux components are currently built ahead of time and committed to this repository as `//build/toolchain/musl-host-gcc/toolchain.tar.xz`. This is the 'sysroot' tarball, that contains all headers and libraries required to build for Metropolis nodes.
-
-To build this tarball, run the following commands:
-
-    bazel build //build/toolchain/musl-host-gcc/sysroot
-    cp -f bazel-bin/build/toolchain/musl-host-gcc/sysroot/sysroot.tar.xz build/toolchain/musl-host-gcc/sysroot.tar.xz
-
-As a temporary hack the compiler-specific headers of our current development container have been manually merged in. This is expected to be replaced by a proper LLVM-based toolchain.
-
-Internals
----------
-
-The toolchain is implemented in the following way:
-
-1. `//build/toolchain/musl-host-gcc/sysroot` is used to build `//build/toolchain/musl-host-gcc/sysroot.tar.xz` which is a tarball that contains all include and binary library files for building against musl for Metropolis nodes (x86\_64 / k8) - these are musl headers, musl libraries, and linux headers. This tarball is committed to source control.
-1. When building a target that uses the toolchain, the `sysroot.tar.xz` tarball is extracted into an external repository `@musl_sysroot`, via `sysroot.bzl` and `sysroot_repository.bzl`.
-1. A toolchain config is built using `//build/toolchain:cc_toolchain_config.bzl`, which points at `gcc-wrapper.sh` as its gcc entrypoint. `gcc-wrapper.sh` expects to be able to call the host gcc with `musl.spec`.
-1. A toolchain is defined in `//build/toolchain/musl-host-gcc:musl_host_toolchain` with a `//build/platforms/linkmode:musl-static` constraint, which is selected by the `//build/platforms:linux_amd64_static` platform.
-
-Quirks
-------
-
-As mentioned above, the musl sysroot is kept in a tarball in this repository. This is obviously suboptimal, but on the other hand gives us an effectively pre-built part of a toolchain. In the future, once we have a hermetic toolchain, a similar tarball might actually contain a fully hermetic toolchain pre-built for k8.
diff --git a/build/toolchain/musl-host-gcc/gcc-wrapper.sh b/build/toolchain/musl-host-gcc/gcc-wrapper.sh
deleted file mode 100755
index 33048c0..0000000
--- a/build/toolchain/musl-host-gcc/gcc-wrapper.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-exec /usr/bin/gcc "$@" -specs $SCRIPT_DIR/musl.spec
diff --git a/build/toolchain/musl-host-gcc/musl.spec b/build/toolchain/musl-host-gcc/musl.spec
deleted file mode 100644
index 49f0176..0000000
--- a/build/toolchain/musl-host-gcc/musl.spec
+++ /dev/null
@@ -1,32 +0,0 @@
-%rename cpp_options old_cpp_options
-
-*cpp_options:
--nostdinc %(old_cpp_options) -isystem $SYSROOT/include
-
-*cc1:
-%(cc1_cpu) -nostdinc -isystem $SYSROOT/include
-
-*link_libgcc:
--L .%s -L %R/lib
-
-*libgcc:
-libgcc.a%s %:if-exists(libgcc_eh.a%s)
-
-*startfile:
-%{static-pie: %R/lib/rcrt1.o; !shared: %R/lib/Scrt1.o} %R/lib/crti.o crtbeginS.o%s
-
-*endfile:
-crtendS.o%s %R/lib/crtn.o
-
-*link:
-%{static-pie: -pie} -no-dynamic-linker -nostdlib -static %{rdynamic:-export-dynamic}
-
-*esp_link:
-
-
-*esp_options:
-
-
-*esp_cpp_options:
-
-
diff --git a/build/toolchain/musl-host-gcc/sysroot.bzl b/build/toolchain/musl-host-gcc/sysroot.bzl
deleted file mode 100644
index 2f54ced..0000000
--- a/build/toolchain/musl-host-gcc/sysroot.bzl
+++ /dev/null
@@ -1,26 +0,0 @@
-#  Copyright 2020 The Monogon Project Authors.
-#
-#  SPDX-License-Identifier: Apache-2.0
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-
-load("//build/toolchain/musl-host-gcc:sysroot_repository.bzl", "musl_sysroot_rule")
-
-def musl_sysroot_repositories():
-    """
-    Provides an external repository that contains the extracted musl/linux sysroot.
-    """
-    musl_sysroot_rule(
-        name = "musl_sysroot",
-        snapshot = "//build/toolchain/musl-host-gcc:sysroot.tar.xz",
-    )
diff --git a/build/toolchain/musl-host-gcc/sysroot.tar.xz b/build/toolchain/musl-host-gcc/sysroot.tar.xz
deleted file mode 100644
index 5fd3f55..0000000
--- a/build/toolchain/musl-host-gcc/sysroot.tar.xz
+++ /dev/null
Binary files differ
diff --git a/build/toolchain/musl-host-gcc/sysroot/BUILD.bazel b/build/toolchain/musl-host-gcc/sysroot/BUILD.bazel
deleted file mode 100644
index dbd2982..0000000
--- a/build/toolchain/musl-host-gcc/sysroot/BUILD.bazel
+++ /dev/null
@@ -1,24 +0,0 @@
-load(":linux.bzl", "linux_headers")
-load(":musl.bzl", "musl_headers")
-load(":tarball.bzl", "musl_gcc_tarball")
-
-linux_headers(
-    name = "linux_headers",
-    src = "@linux//:all",
-    arch = "x86_64",
-    visibility = ["//visibility:public"],
-)
-
-musl_headers(
-    name = "musl_headers",
-    src = "@musl//:all",
-    arch = "x86_64",
-    visibility = ["//visibility:public"],
-)
-
-musl_gcc_tarball(
-    name = "sysroot",
-    linux_headers = ":linux_headers",
-    musl = "//third_party/musl",
-    musl_headers = ":musl_headers",
-)
diff --git a/build/toolchain/musl-host-gcc/sysroot/linux.bzl b/build/toolchain/musl-host-gcc/sysroot/linux.bzl
deleted file mode 100644
index 0d6b999..0000000
--- a/build/toolchain/musl-host-gcc/sysroot/linux.bzl
+++ /dev/null
@@ -1,44 +0,0 @@
-#  Copyright 2020 The Monogon Project Authors.
-#
-#  SPDX-License-Identifier: Apache-2.0
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-
-load(
-    "//build/utils:detect_root.bzl",
-    "detect_root",
-)
-
-def _linux_headers(ctx):
-    hdrs_name = ctx.attr.name + "_headers"
-    hdrs_dir = ctx.actions.declare_directory(hdrs_name)
-
-    root = detect_root(ctx.attr.src)
-    ctx.actions.run_shell(
-        inputs = ctx.files.src,
-        outputs = [hdrs_dir],
-        progress_message = "Generating Linux Kernel Headers",
-        mnemonic = "LinuxCollectHeaders",
-        arguments = [root, ctx.attr.arch, hdrs_dir.path],
-        use_default_shell_env = True,
-        command = "make -C \"$1\" headers_install ARCH=\"$2\" INSTALL_HDR_PATH=\"$(pwd)/$3\" > /dev/null && mv \"$3/include/\"* \"$3/\" && rmdir \"$3/include\"",
-    )
-    return [DefaultInfo(files = depset([hdrs_dir]))]
-
-linux_headers = rule(
-    implementation = _linux_headers,
-    attrs = {
-        "src": attr.label(mandatory = True),
-        "arch": attr.string(mandatory = True),
-    },
-)
diff --git a/build/toolchain/musl-host-gcc/sysroot/musl.bzl b/build/toolchain/musl-host-gcc/sysroot/musl.bzl
deleted file mode 100644
index f5dba26..0000000
--- a/build/toolchain/musl-host-gcc/sysroot/musl.bzl
+++ /dev/null
@@ -1,44 +0,0 @@
-#  Copyright 2020 The Monogon Project Authors.
-#
-#  SPDX-License-Identifier: Apache-2.0
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-
-load(
-    "//build/utils:detect_root.bzl",
-    "detect_root",
-)
-
-def _musl_headers(ctx):
-    hdrs_name = ctx.attr.name + "_headers"
-    hdrs_dir = ctx.actions.declare_directory(hdrs_name)
-
-    root = detect_root(ctx.attr.src)
-    ctx.actions.run_shell(
-        inputs = ctx.files.src,
-        outputs = [hdrs_dir],
-        progress_message = "Collecting musl headers",
-        mnemonic = "MuslCollectHeaders",
-        arguments = [root, ctx.attr.arch, hdrs_dir.path],
-        use_default_shell_env = True,
-        command = "make -C \"$1\" install-headers ARCH=\"$2\" includedir=\"$(pwd)/$3\" > /dev/null",
-    )
-    return [DefaultInfo(files = depset([hdrs_dir]))]
-
-musl_headers = rule(
-    implementation = _musl_headers,
-    attrs = {
-        "src": attr.label(mandatory = True),
-        "arch": attr.string(mandatory = True),
-    },
-)
diff --git a/build/toolchain/musl-host-gcc/sysroot/tarball.bzl b/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
deleted file mode 100644
index a7e407d..0000000
--- a/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
+++ /dev/null
@@ -1,82 +0,0 @@
-#  Copyright 2020 The Monogon Project Authors.
-#
-#  SPDX-License-Identifier: Apache-2.0
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-
-"""
-Build a sysroot-style tarball containing musl/linux headers and libraries.
-
-This can then be used to build a C toolchain that builds C/C++ binaries for Metropolis nodes.
-"""
-
-load(
-    "//build/utils:detect_root.bzl",
-    "detect_root",
-)
-
-def _musl_gcc_tarball(ctx):
-    tarball_name = ctx.attr.name + ".tar.xz"
-    tarball = ctx.actions.declare_file(tarball_name)
-
-    musl_headers = ctx.file.musl_headers
-    musl_headers_path = musl_headers.path
-    linux_headers = ctx.file.linux_headers
-    linux_headers_path = linux_headers.path
-
-    compiler_headers_path = "lib/gcc/x86_64-redhat-linux/14/include"
-
-    musl_root = detect_root(ctx.attr.musl)
-
-    # This builds a tarball containing musl, musl headers and linux headers.
-    # This is done by some carefully crafted tar command line arguments that rewrite
-    # paths to ensure that everything lands in lib/ and include/ in the tarball.
-
-    # TODO(q3k): write nice, small static Go utility for this.
-
-    arguments = [tarball.path]
-    command = "tar -chJf $1"
-
-    # Order is important here as this is a terrible hack producing a tar file with duplicate files. The decompressor
-    # will then overwrite the wrong one with the correct one for us.
-    arguments.append(compiler_headers_path)
-    command += " --transform 's|^'$2'|include|' /$2"
-
-    arguments.append(musl_headers_path)
-    command += " --transform 's|^'$3'|include|' $3"
-
-    arguments.append(linux_headers_path)
-    command += " --transform 's|^'$4'|include|' $4"
-
-    arguments.append(musl_root)
-    command += " --transform 's|^'$5'|lib|' $5"
-
-    ctx.actions.run_shell(
-        inputs = [musl_headers, linux_headers] + ctx.files.musl,
-        outputs = [tarball],
-        progress_message = "Building toolchain tarball",
-        mnemonic = "BuildToolchainTarball",
-        arguments = arguments,
-        use_default_shell_env = True,
-        command = command,
-    )
-    return [DefaultInfo(files = depset([tarball]))]
-
-musl_gcc_tarball = rule(
-    implementation = _musl_gcc_tarball,
-    attrs = {
-        "musl": attr.label(mandatory = True),
-        "musl_headers": attr.label(mandatory = True, allow_single_file = True),
-        "linux_headers": attr.label(mandatory = True, allow_single_file = True),
-    },
-)
diff --git a/build/toolchain/musl-host-gcc/sysroot_repository.bzl b/build/toolchain/musl-host-gcc/sysroot_repository.bzl
deleted file mode 100644
index 72882ea..0000000
--- a/build/toolchain/musl-host-gcc/sysroot_repository.bzl
+++ /dev/null
@@ -1,41 +0,0 @@
-#  Copyright 2020 The Monogon Project Authors.
-#
-#  SPDX-License-Identifier: Apache-2.0
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-
-"""
-A generic workspace rule that extracts some subpaths from a tarball.
-
-TODO(q3k): This should maybe be moved to //build/utils and called differently.
-"""
-
-def _musl_sysroot_rule_impl(rctx):
-    rctx.extract(rctx.attr.snapshot)
-    rctx.file("BUILD.bazel", """
-filegroup(
-    name = "all",
-    srcs = glob(["include/**", "lib/**"]),
-    visibility = ["//visibility:public"],
-)
-""")
-
-musl_sysroot_rule = repository_rule(
-    implementation = _musl_sysroot_rule_impl,
-    attrs = {
-        "snapshot": attr.label(
-            default = Label("//build/toolchain/musl-host-gcc:sysroot.tar.xz"),
-            allow_single_file = True,
-        ),
-    },
-)
diff --git a/go.mod b/go.mod
index 1118465..0418912 100644
--- a/go.mod
+++ b/go.mod
@@ -50,6 +50,9 @@
 // organization at once.
 replace github.com/packethost/packngo => github.com/monogon-dev/packngo v0.0.0-20240122175436-ecbd9eb00ddb
 
+// https://github.com/mattn/go-sqlite3/issues/1164
+replace github.com/mattn/go-sqlite3 => github.com/mattn/go-sqlite3 v1.14.24
+
 require (
 	4d63.com/gocheckcompilerdirectives v1.2.1
 	cloud.google.com/go/storage v1.43.0
diff --git a/go.sum b/go.sum
index d7d264a..e99a1be 100644
--- a/go.sum
+++ b/go.sum
@@ -2409,11 +2409,8 @@
 github.com/mattn/go-shellwords v1.0.10/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
-github.com/mattn/go-sqlite3 v1.14.16/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
-github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
-github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM=
+github.com/mattn/go-sqlite3 v1.14.24/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mattn/go-xmlrpc v0.0.3 h1:Y6WEMLEsqs3RviBrAa1/7qmbGB7DVD3brZIbqMbQdGY=
 github.com/mattn/go-xmlrpc v0.0.3/go.mod h1:mqc2dz7tP5x5BKlCahN/n+hs7OSZKJkS9JsHNBRlrxA=
 github.com/mattn/go-zglob v0.0.1/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
diff --git a/osbase/build/def.bzl b/osbase/build/def.bzl
index 685c616..c7f189a 100644
--- a/osbase/build/def.bzl
+++ b/osbase/build/def.bzl
@@ -6,7 +6,7 @@
     """
     return {
         "@io_bazel_rules_go//go/config:static": True,
-        "//build/platforms/linkmode:static": True,
+        "@toolchain_cc_mngn//buildmode:static": True,
     }
 
 build_static_transition = transition(
@@ -14,7 +14,7 @@
     inputs = [],
     outputs = [
         "@io_bazel_rules_go//go/config:static",
-        "//build/platforms/linkmode:static",
+        "@toolchain_cc_mngn//buildmode:static",
     ],
 )
 
@@ -61,7 +61,7 @@
     # to a stable hash.
     # See the transition's comment block for more information.
     "@io_bazel_rules_go//go/config:static": False,
-    "//build/platforms/linkmode:static": False,
+    "@toolchain_cc_mngn//buildmode:static": False,
 }
 
 def _ignore_unused_configuration_impl(_settings, _attr):