diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 597c5d8..98fc1cf 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -1,6 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("//metropolis/node/build:def.bzl", "erofs_image", "verity_image")
 load("//metropolis/node/build:efi.bzl", "efi_unified_kernel_image")
+load("//metropolis/node/build/mkimage:def.bzl", "node_image")
 load("//metropolis/node/build/fwprune:def.bzl", "fsspec_linux_firmware")
 load("//metropolis/node/build/mkucode:def.bzl", "cpio_ucode")
 load("@rules_pkg//:pkg.bzl", "pkg_zip")
@@ -142,24 +143,10 @@
     visibility = ["//visibility:public"],
 )
 
-genrule(
+node_image(
     name = "image",
-    srcs = [
-        ":kernel_efi",
-        ":verity_rootfs",
-    ],
-    outs = [
-        "node.img",
-    ],
-    cmd = """
-    $(location //metropolis/node/build/mkimage) \
-        -efi $(location :kernel_efi) \
-        -system $(location :verity_rootfs) \
-        -out $@
-    """,
-    tools = [
-        "//metropolis/node/build/mkimage",
-    ],
+    kernel = ":kernel_efi",
+    system = ":verity_rootfs",
     visibility = [
         "//metropolis/cli/metroctl/test:__subpackages__",
         "//metropolis/test/e2e:__subpackages__",
diff --git a/metropolis/node/build/mkimage/def.bzl b/metropolis/node/build/mkimage/def.bzl
new file mode 100644
index 0000000..efcebdc
--- /dev/null
+++ b/metropolis/node/build/mkimage/def.bzl
@@ -0,0 +1,48 @@
+def _node_image_impl(ctx):
+    img_file = ctx.actions.declare_file(ctx.label.name + ".img")
+    ctx.actions.run(
+        mnemonic = "MkImage",
+        executable = ctx.executable._mkimage,
+        arguments = [
+            "-efi",
+            ctx.file.kernel.path,
+            "-system",
+            ctx.file.system.path,
+            "-out",
+            img_file.path,
+        ],
+        inputs = [
+            ctx.file.kernel,
+            ctx.file.system,
+        ],
+        outputs = [img_file],
+    )
+
+    return [DefaultInfo(files = depset([img_file]), runfiles = ctx.runfiles(files = [img_file]))]
+
+node_image = rule(
+    implementation = _node_image_impl,
+    doc = """
+        Build a disk image from an EFI kernel payload and system partition
+        contents. See //metropolis/node/build/mkimage for more information.
+    """,
+    attrs = {
+        "kernel": attr.label(
+            doc = "EFI binary containing a kernel.",
+            mandatory = True,
+            allow_single_file = True,
+        ),
+        "system": attr.label(
+            doc = "Contents of the system partition.",
+            mandatory = True,
+            allow_single_file = True,
+        ),
+        "_mkimage": attr.label(
+            doc = "The mkimage executable.",
+            default = "//metropolis/node/build/mkimage",
+            allow_single_file = True,
+            executable = True,
+            cfg = "exec",
+        ),
+    },
+)
diff --git a/metropolis/test/launch/cluster/cluster.go b/metropolis/test/launch/cluster/cluster.go
index cc5d72f..a312e86 100644
--- a/metropolis/test/launch/cluster/cluster.go
+++ b/metropolis/test/launch/cluster/cluster.go
@@ -130,7 +130,7 @@
 	}
 
 	// Initialize the node's storage with a prebuilt image.
-	si, err := datafile.ResolveRunfile("metropolis/node/node.img")
+	si, err := datafile.ResolveRunfile("metropolis/node/image.img")
 	if err != nil {
 		return nil, fmt.Errorf("while resolving a path: %w", err)
 	}
@@ -278,7 +278,7 @@
 
 	tpmSocketPath := filepath.Join(r.sd, "tpm-socket")
 	fwVarPath := filepath.Join(r.ld, "OVMF_VARS.fd")
-	storagePath := filepath.Join(r.ld, "node.img")
+	storagePath := filepath.Join(r.ld, "image.img")
 	qemuArgs := []string{
 		"-machine", "q35", "-accel", "kvm", "-nographic", "-nodefaults", "-m", "4096",
 		"-cpu", "host", "-smp", "sockets=1,cpus=1,cores=2,threads=2,maxcpus=4",