diff --git a/MODULE.bazel b/MODULE.bazel
index c2c4122..241841f 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -58,6 +58,7 @@
 bazel_dep(name = "rules_rust_protobuf", version = RULES_RUST_VERSION)
 bazel_dep(name = "zlib", version = "1.3.1.bcr.6")
 bazel_dep(name = "boringssl", version = "0.20250514.0")
+bazel_dep(name = "libcap", version = "2.27")
 bazel_dep(name = "glib", version = "2.82.2.bcr.5")
 bazel_dep(name = "buildifier_prebuilt", version = "8.2.0.2")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 6e9c814..7febfbd 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -66,6 +66,8 @@
     "https://bcr.bazel.build/modules/jsoncpp/1.9.5/MODULE.bazel": "31271aedc59e815656f5736f282bb7509a97c7ecb43e927ac1a37966e0578075",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/MODULE.bazel": "2f8d20d3b7d54143213c4dfc3d98225c42de7d666011528dc8fe91591e2e17b0",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/source.json": "a04756d367a2126c3541682864ecec52f92cdee80a35735a3cb249ce015ca000",
+    "https://bcr.bazel.build/modules/libcap/2.27/MODULE.bazel": "93bf71fa6c6d61fed82bac65c9287619fed2720ea7e89614e57ecebbb5c3c619",
+    "https://bcr.bazel.build/modules/libcap/2.27/source.json": "f6a3a6e56d9c99b86b789d9e51654bc6fe84db7dbae46eb404581179afc03b4b",
     "https://bcr.bazel.build/modules/libffi/3.4.7.bcr.3/MODULE.bazel": "2aaa0e32669002a26ffe421e98913ed70fa5ee21c36fc51d2d51053a5ed07420",
     "https://bcr.bazel.build/modules/libffi/3.4.7.bcr.3/source.json": "fdffd7d4e35124905988e03a5f7ced705df34f5e5134445b7f17f1ecaede9df2",
     "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
diff --git a/build/bazel/third_party.MODULE.bazel b/build/bazel/third_party.MODULE.bazel
index b530fe5..15f6ed0 100644
--- a/build/bazel/third_party.MODULE.bazel
+++ b/build/bazel/third_party.MODULE.bazel
@@ -214,20 +214,6 @@
     urls = ["https://chrony-project.org/releases/chrony-%s.tar.gz" % CHRONY_VERSION],
 )
 
-CAP_VERSION = "1.2.55"
-
-http_archive(
-    name = "cap",
-    build_file = "//third_party/cap:cap.bzl",
-    integrity = "sha256-4pMiAy6pTpBpauLRdTDtyRTHF2UjLuj9T944umOcslY=",
-    patch_args = ["-p1"],
-    patches = [
-        "//third_party/cap/patches:add_go_codegen.patch",
-    ],
-    strip_prefix = "libcap-cap/v%s/libcap" % CAP_VERSION,
-    urls = ["https://git.kernel.org/pub/scm/libs/libcap/libcap.git/snapshot/libcap-cap/v%s.tar.gz" % CAP_VERSION],
-)
-
 GNUEFI_VERSION = "3.0.14"
 
 http_archive(
diff --git a/third_party/cap/BUILD.bazel b/third_party/cap/BUILD.bazel
deleted file mode 100644
index e69de29..0000000
--- a/third_party/cap/BUILD.bazel
+++ /dev/null
diff --git a/third_party/cap/cap.bzl b/third_party/cap/cap.bzl
deleted file mode 100644
index 5d93890..0000000
--- a/third_party/cap/cap.bzl
+++ /dev/null
@@ -1,52 +0,0 @@
-#  Copyright 2021 The Monogon Project Authors.
-#
-#  SPDX-License-Identifier: Apache-2.0
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-
-load("@io_bazel_rules_go//go:def.bzl", "go_binary")
-load("@rules_cc//cc:defs.bzl", "cc_library")
-
-cc_library(
-    name = "cap",
-    srcs = [
-        "cap_alloc.c",
-        "cap_extint.c",
-        "cap_file.c",
-        "cap_flag.c",
-        "cap_proc.c",
-        "cap_text.c",
-    ] + glob(["include/sys/*.h"]),  # UAPI is intentionally excluded as we want it from our own kernel headers
-    hdrs = ["libcap.h", ":cap_names.h"],
-    visibility = ["//visibility:public"],
-    includes = [".", "include"],
-)
-
-go_binary(
-    name = "makenames",
-    srcs = ["makenames.go"],
-)
-
-genrule(
-    name = "cap_names_hdr",
-    srcs = [
-        "include/uapi/linux/capability.h",
-    ],
-    outs = [
-        "cap_names.h",
-    ],
-    cmd = "$(location :makenames) \"$(location include/uapi/linux/capability.h)\" \"$@\"",
-    tools = [
-        ":makenames",
-    ],
-)
diff --git a/third_party/cap/patches/BUILD.bazel b/third_party/cap/patches/BUILD.bazel
deleted file mode 100644
index e69de29..0000000
--- a/third_party/cap/patches/BUILD.bazel
+++ /dev/null
diff --git a/third_party/cap/patches/add_go_codegen.patch b/third_party/cap/patches/add_go_codegen.patch
deleted file mode 100644
index 2572367..0000000
--- a/third_party/cap/patches/add_go_codegen.patch
+++ /dev/null
@@ -1,78 +0,0 @@
---- /dev/null
-+++ b/makenames.go
-@@ -0,0 +1,73 @@
-+// makenames replaces the built-in array generation consisting of Perl incantations being
-+// consumed by C code with a single implementation that's shorter anyways.
-+package main
-+
-+import (
-+   "io/ioutil"
-+	"log"
-+	"os"
-+	"regexp"
-+	"strconv"
-+	"strings"
-+	"text/template"
-+)
-+
-+type tmplParams struct {
-+	Bits     int
-+	NameSize int
-+	Caps     []string
-+}
-+
-+var capNamesTmpl = template.Must(template.New("cap_names").Parse(`/*
-+ * DO NOT EDIT: this file is generated automatically from
-+ *
-+ *     <uapi/linux/capability.h>
-+ */
-+
-+#define __CAP_BITS       {{ .Bits }}
-+#define __CAP_NAME_SIZE  {{ .NameSize }}
-+
-+#ifdef LIBCAP_PLEASE_INCLUDE_ARRAY
-+#define LIBCAP_CAP_NAMES { \
-+{{ range $i, $name := .Caps }}      /* {{ $i }} */	{{ if $name }}"{{ $name }}"{{else}}NULL,		/* - presently unused */{{end}}, \
-+{{end}}  }
-+#endif /* LIBCAP_PLEASE_INCLUDE_ARRAY */
-+
-+/* END OF FILE */
-+`))
-+
-+var capRe = regexp.MustCompile(`(?m)^#define[ \t](CAP[_A-Z]+)[ \t]+([0-9]+)\s+$`)
-+
-+func main() {
-+	sourceFile, err := ioutil.ReadFile(os.Args[1])
-+	if err != nil {
-+		log.Fatalln(err)
-+	}
-+
-+	matches := capRe.FindAllStringSubmatch(string(sourceFile), -1)
-+	out := tmplParams{
-+		Caps: make([]string, 1024),
-+	}
-+	for _, m := range matches {
-+		i, err := strconv.Atoi(m[2])
-+		if err != nil {
-+			log.Fatalln(err)
-+		}
-+		if i+1 > out.Bits {
-+			out.Bits = i + 1
-+		}
-+		if len(m[1])+1 > out.NameSize {
-+			out.NameSize = len(m[1]) + 1
-+		}
-+		out.Caps[i] = strings.ToLower(m[1])
-+	}
-+	out.Caps = out.Caps[:out.Bits]
-+	outFile, err := os.Create(os.Args[2])
-+	if err != nil {
-+		log.Fatalln(err)
-+	}
-+	if err := capNamesTmpl.ExecuteTemplate(outFile, "cap_names", &out); err != nil {
-+		log.Fatalln(err)
-+	}
-+	outFile.Close()
-+}
---
-2.25.1
diff --git a/third_party/chrony/chrony.bzl b/third_party/chrony/chrony.bzl
index afecf26..812d536 100644
--- a/third_party/chrony/chrony.bzl
+++ b/third_party/chrony/chrony.bzl
@@ -153,7 +153,7 @@
     deps = [
         ":common",
         "@seccomp//:seccomp",
-        "@cap//:cap",
+        "@libcap//:libcap",
     ],
 )