diff --git a/build/toolchain/musl-host-gcc/BUILD.bazel b/build/toolchain/musl-host-gcc/BUILD.bazel
index 94f2953..2d1524f 100644
--- a/build/toolchain/musl-host-gcc/BUILD.bazel
+++ b/build/toolchain/musl-host-gcc/BUILD.bazel
@@ -29,7 +29,7 @@
     has_cpp = False,
     host_includes = [],
     is_glibc = False,
-    sysroot = "external/_main~_repo_rules~musl_sysroot",
+    sysroot = package_relative_label("@musl_sysroot//:all").workspace_root,
 )
 
 filegroup(
diff --git a/third_party/edk2/external/BUILD.repo b/third_party/edk2/external/BUILD.repo
index acb27b8..43effe5 100644
--- a/third_party/edk2/external/BUILD.repo
+++ b/third_party/edk2/external/BUILD.repo
@@ -1,5 +1,5 @@
-genrule(
-    name = "firmware",
+filegroup(
+    name = "all",
     srcs = glob(
         ["**"],
         exclude = [
@@ -7,6 +7,11 @@
             "CryptoPkg/Library/OpensslLib/openssl/fuzz/corpora/**",
         ],
     ),
+)
+
+genrule(
+    name = "firmware",
+    srcs = [":all"],
     outs = [
         "OVMF_CODE.fd",
         "OVMF_VARS.fd",
@@ -16,13 +21,14 @@
         # The edk2 build does not like Bazel's default genrule environment.
         set +u
 
-        cd external/_main~_repo_rules~edk2
+        cd {path}
         . edksetup.sh
         make -C BaseTools/Source/C
         build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -t GCC5 -a X64 -b RELEASE -p $$PWD/OvmfPkg/OvmfPkgX64.dsc
     ) > /dev/null
 
-    cp external/_main~_repo_rules~edk2/Build/OvmfX64/RELEASE_GCC5/FV/{OVMF_CODE.fd,OVMF_VARS.fd} $(RULEDIR)
-    """,
+    cp {path}/Build/OvmfX64/RELEASE_GCC5/FV/OVMF_CODE.fd $(RULEDIR)
+    cp {path}/Build/OvmfX64/RELEASE_GCC5/FV/OVMF_VARS.fd $(RULEDIR)
+    """.format(path = package_relative_label(":all").workspace_root),
     visibility = ["//visibility:public"],
 )
diff --git a/third_party/libtpms/patches/0006-bazel-support-implement.patch b/third_party/libtpms/patches/0006-bazel-support-implement.patch
index ed540b1..47ce11a 100644
--- a/third_party/libtpms/patches/0006-bazel-support-implement.patch
+++ b/third_party/libtpms/patches/0006-bazel-support-implement.patch
@@ -19,18 +19,24 @@
 index 0000000..591942d
 --- /dev/null
 +++ b/BUILD.bazel
-@@ -0,0 +1,45 @@
+@@ -0,0 +1,51 @@
++filegroup(
++    name = "all",
++    srcs = glob(["**"]),
++    visibility = ["//visibility:public"],
++)
++
 +cc_library(
 +    name = "libtpms_tpm2",
 +    includes = [
 +        "include",
 +    ],
 +    copts = [
-+        "-Iexternal/_main~_repo_rules~libtpms/include/libtpms",
-+        "-Iexternal/_main~_repo_rules~libtpms/src",
-+        "-Iexternal/_main~_repo_rules~libtpms/src/tpm2",
-+        "-Iexternal/_main~_repo_rules~libtpms/src/tpm2/crypto",
-+        "-Iexternal/_main~_repo_rules~libtpms/src/tpm2/crypto/openssl",
++        "-I{path}/include/libtpms".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/src".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/src/tpm2".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/src/tpm2/crypto".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/src/tpm2/crypto/openssl".format(path = package_relative_label(":all").workspace_root),
 +    ],
 +    defines = [
 +        "TPM_LIBTPMS_CALLBACKS",
diff --git a/third_party/musl/BUILD.bazel b/third_party/musl/BUILD.bazel
index 91d7398..1ce390c 100644
--- a/third_party/musl/BUILD.bazel
+++ b/third_party/musl/BUILD.bazel
@@ -27,10 +27,10 @@
     cmd = """
     OUT=$$PWD/$(RULEDIR)
     (
-        cd external/_main~_repo_rules~musl
+        cd {path}
         ./configure --prefix=$$OUT --syslibdir=$$OUT --libdir=$$OUT
         make -j $$(nproc) install-libs
     ) > /dev/null
-    """,
+    """.format(path = package_relative_label("@musl//:all").workspace_root),
     visibility = ["//visibility:public"],
 )
diff --git a/third_party/qemu/patches/bazel_support.patch b/third_party/qemu/patches/bazel_support.patch
index 2b2c66a..9c78ff8 100644
--- a/third_party/qemu/patches/bazel_support.patch
+++ b/third_party/qemu/patches/bazel_support.patch
@@ -1684,7 +1684,7 @@
 +def _impl_cc_qemu_trace(ctx):
 +    outs = []
 +    for src in ctx.files.srcs:
-+        name = src.path.replace("external/_main~_repo_rules~qemu/", "").replace("/trace-events", "").replace("/", "_")
++        name = src.path.replace(ctx.label.workspace_root + "/", "").replace("/trace-events", "").replace("/", "_")
 +        if name == "trace-events":
 +            name = "root"
 +        trace_h = ctx.actions.declare_file("trace-{}.h".format(name))
diff --git a/third_party/qemu/patches/pregenerated_config_files.patch b/third_party/qemu/patches/pregenerated_config_files.patch
index 8facc61..9f72837 100644
--- a/third_party/qemu/patches/pregenerated_config_files.patch
+++ b/third_party/qemu/patches/pregenerated_config_files.patch
@@ -198,7 +198,7 @@
 +
 +#define CONFIG_QEMU_DESKTOPDIR "/nonexistent"
 +
-+#define CONFIG_QEMU_FIRMWAREPATH "external/_main~_repo_rules~qemu/pc-bios"
++#define CONFIG_QEMU_FIRMWAREPATH "/nonexistent"
 +
 +#define CONFIG_QEMU_HELPERDIR "/nonexistent"
 +
diff --git a/third_party/swtpm/patches/0004-bazel-support-implement.patch b/third_party/swtpm/patches/0004-bazel-support-implement.patch
index ce69992..b37ea69 100644
--- a/third_party/swtpm/patches/0004-bazel-support-implement.patch
+++ b/third_party/swtpm/patches/0004-bazel-support-implement.patch
@@ -43,7 +43,13 @@
 index 0000000..acddc0e
 --- /dev/null
 +++ b/BUILD.bazel
-@@ -0,0 +1,94 @@
+@@ -0,0 +1,100 @@
++filegroup(
++    name = "all",
++    srcs = glob(["**"]),
++    visibility = ["//visibility:public"],
++)
++
 +cc_binary(
 +    name = "swtpm",
 +    deps = [
@@ -64,9 +70,9 @@
 +        "src/utils/swtpm_utils.c",
 +    ]),
 +    copts = [
-+        "-Iexternal/_main~_repo_rules~swtpm/include",
-+        "-Iexternal/_main~_repo_rules~swtpm/include/swtpm",
-+        "-Iexternal/_main~_repo_rules~swtpm/src/utils",
++        "-I{path}/include".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/include/swtpm".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/src/utils".format(path = package_relative_label(":all").workspace_root),
 +    ],
 +    visibility = [
 +        "//visibility:public",
@@ -88,9 +94,9 @@
 +        "src/utils/*.c",
 +    ], []),
 +    copts = [
-+        "-Iexternal/_main~_repo_rules~swtpm/include",
-+        "-Iexternal/_main~_repo_rules~swtpm/include/swtpm",
-+        "-Iexternal/_main~_repo_rules~swtpm/src/utils",
++        "-I{path}/include".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/include/swtpm".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/src/utils".format(path = package_relative_label(":all").workspace_root),
 +    ],
 +    visibility = [
 +        "//visibility:public",
@@ -112,9 +118,9 @@
 +        "src/utils/*.c",
 +    ], []),
 +    copts = [
-+        "-Iexternal/_main~_repo_rules~swtpm/include",
-+        "-Iexternal/_main~_repo_rules~swtpm/include/swtpm",
-+        "-Iexternal/_main~_repo_rules~swtpm/src/utils",
++        "-I{path}/include".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/include/swtpm".format(path = package_relative_label(":all").workspace_root),
++        "-I{path}/src/utils".format(path = package_relative_label(":all").workspace_root),
 +    ],
 +    visibility = [
 +        "//visibility:public",
@@ -132,7 +138,7 @@
 +        "include/*.h",
 +    ], []),
 +    copts = [
-+        "-Iexternal/_main~_repo_rules~swtpm/include",
++        "-I{path}/include".format(path = package_relative_label(":all").workspace_root),
 +    ],
 +    visibility = [
 +        "//visibility:public",