diff --git a/third_party/edk2/external/BUILD.repo b/third_party/edk2/external/BUILD.repo
index acb27b8..43effe5 100644
--- a/third_party/edk2/external/BUILD.repo
+++ b/third_party/edk2/external/BUILD.repo
@@ -1,5 +1,5 @@
-genrule(
-    name = "firmware",
+filegroup(
+    name = "all",
     srcs = glob(
         ["**"],
         exclude = [
@@ -7,6 +7,11 @@
             "CryptoPkg/Library/OpensslLib/openssl/fuzz/corpora/**",
         ],
     ),
+)
+
+genrule(
+    name = "firmware",
+    srcs = [":all"],
     outs = [
         "OVMF_CODE.fd",
         "OVMF_VARS.fd",
@@ -16,13 +21,14 @@
         # The edk2 build does not like Bazel's default genrule environment.
         set +u
 
-        cd external/_main~_repo_rules~edk2
+        cd {path}
         . edksetup.sh
         make -C BaseTools/Source/C
         build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -t GCC5 -a X64 -b RELEASE -p $$PWD/OvmfPkg/OvmfPkgX64.dsc
     ) > /dev/null
 
-    cp external/_main~_repo_rules~edk2/Build/OvmfX64/RELEASE_GCC5/FV/{OVMF_CODE.fd,OVMF_VARS.fd} $(RULEDIR)
-    """,
+    cp {path}/Build/OvmfX64/RELEASE_GCC5/FV/OVMF_CODE.fd $(RULEDIR)
+    cp {path}/Build/OvmfX64/RELEASE_GCC5/FV/OVMF_VARS.fd $(RULEDIR)
+    """.format(path = package_relative_label(":all").workspace_root),
     visibility = ["//visibility:public"],
 )