diff --git a/third_party/rules_rust/BUILD.bazel b/third_party/rules_rust/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/rules_rust/BUILD.bazel
diff --git a/third_party/rules_rust/rust-prost-nostd.patch b/third_party/rules_rust/rust-prost-nostd.patch
new file mode 100644
index 0000000..557a7c2
--- /dev/null
+++ b/third_party/rules_rust/rust-prost-nostd.patch
@@ -0,0 +1,119 @@
+From a3a14a5fe78a5f3d366fe2d0f3fcfb9ededc587b Mon Sep 17 00:00:00 2001
+From: Lorenz Brun <lorenz@monogon.tech>
+Date: Wed, 25 Sep 2024 02:37:42 +0200
+Subject: [PATCH 2/4] Support no_std in Prost toolchain
+
+---
+ proto/prost/private/prost.bzl         |  8 ++++++++
+ proto/prost/private/protoc_wrapper.rs | 19 +++++++++++++++++--
+ 2 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/proto/prost/private/prost.bzl b/proto/prost/private/prost.bzl
+index cf5e11c9..61d0bc63 100644
+--- a/proto/prost/private/prost.bzl
++++ b/proto/prost/private/prost.bzl
+@@ -67,6 +67,9 @@ def _compile_proto(ctx, crate_name, proto_info, deps, prost_toolchain, rustfmt_t
+     additional_args.add("--descriptor_set={}".format(proto_info.direct_descriptor_set.path))
+     additional_args.add_all(prost_toolchain.prost_opts, format_each = "--prost_opt=%s")
+
++    if prost_toolchain.is_nostd:
++        additional_args.add("--is_nostd")
++
+     if prost_toolchain.tonic_plugin:
+         tonic_plugin = prost_toolchain.tonic_plugin[DefaultInfo].files_to_run
+         additional_args.add(prost_toolchain.tonic_plugin_flag % tonic_plugin.executable.path)
+@@ -387,6 +390,7 @@ def _rust_prost_toolchain_impl(ctx):
+         tonic_plugin_flag = ctx.attr.tonic_plugin_flag,
+         tonic_runtime = ctx.attr.tonic_runtime,
+         include_transitive_deps = ctx.attr.include_transitive_deps,
++        is_nostd = ctx.attr.is_nostd,
+     )]
+
+ rust_prost_toolchain = rule(
+@@ -442,6 +446,10 @@ rust_prost_toolchain = rule(
+             doc = "The Tonic runtime crates to use.",
+             providers = [[rust_common.crate_info], [rust_common.crate_group_info]],
+         ),
++        "is_nostd": attr.bool(
++            doc = "If a no_std tag should be put into the generated code.",
++            default = False,
++        ),
+     }, **proto_toolchains.if_legacy_toolchain({
+         "_legacy_proto_toolchain": attr.label(
+             default = "//proto/protobuf:legacy_proto_toolchain",
+diff --git a/proto/prost/private/protoc_wrapper.rs b/proto/prost/private/protoc_wrapper.rs
+index ff4decd4..2c32ea35 100644
+--- a/proto/prost/private/protoc_wrapper.rs
++++ b/proto/prost/private/protoc_wrapper.rs
+@@ -152,8 +152,13 @@ fn generate_lib_rs(
+     prost_outputs: &BTreeSet<PathBuf>,
+     is_tonic: bool,
+     direct_dep_crate_names: Vec<String>,
++    is_nostd: bool,
+ ) -> String {
+-    let mut contents = vec!["// @generated".to_string(), "".to_string()];
++    let mut contents = vec![
++        if is_nostd { "#![no_std]".to_string() } else { "".to_string() },
++        "// @generated".to_string(),
++        "".to_string(),
++    ];
+     for crate_name in direct_dep_crate_names {
+         contents.push(format!("pub use {crate_name};"));
+     }
+@@ -442,6 +447,9 @@ struct Args {
+     /// Whether to generate tonic code.
+     is_tonic: bool,
+
++    // Whether to put a no_std tag into the generated code.
++    is_nostd: bool,
++
+     /// Extra arguments to pass to protoc.
+     extra_args: Vec<String>,
+ }
+@@ -463,6 +471,7 @@ impl Args {
+         let mut tonic_or_prost_opts = Vec::new();
+         let mut direct_dep_crate_names = Vec::new();
+         let mut is_tonic = false;
++        let mut is_nostd = false;
+
+         let mut extra_args = Vec::new();
+
+@@ -485,6 +494,10 @@ impl Args {
+                 is_tonic = true;
+                 return;
+             }
++            if arg == "--is_nostd" {
++                is_nostd = true;
++                return;
++            }
+
+             if !arg.contains('=') {
+                 extra_args.push(arg);
+@@ -621,6 +634,7 @@ impl Args {
+             proto_paths,
+             direct_dep_crate_names,
+             is_tonic,
++            is_nostd,
+             label: label.unwrap(),
+             extra_args,
+         })
+@@ -727,6 +741,7 @@ fn main() {
+         proto_paths,
+         direct_dep_crate_names,
+         is_tonic,
++        is_nostd,
+         extra_args,
+     } = Args::parse().expect("Failed to parse args");
+
+@@ -841,7 +856,7 @@ fn main() {
+     // Write outputs
+     fs::write(
+         &out_librs,
+-        generate_lib_rs(&rust_files, is_tonic, direct_dep_crate_names),
++        generate_lib_rs(&rust_files, is_tonic, direct_dep_crate_names, is_nostd),
+     )
+     .expect("Failed to write file.");
+     fs::write(
+--
+2.44.1
+
diff --git a/third_party/rules_rust/rust-reproducibility.patch b/third_party/rules_rust/rust-reproducibility.patch
new file mode 100644
index 0000000..e0254f2
--- /dev/null
+++ b/third_party/rules_rust/rust-reproducibility.patch
@@ -0,0 +1,149 @@
+From 544ee8b571a006a8e03eb4401f6644bb8bf6628f Mon Sep 17 00:00:00 2001
+From: Serge Bazanski <serge@monogon.tech>
+Date: Wed, 25 Sep 2024 02:38:50 +0200
+Subject: [PATCH] Improve reproducibility
+
+Fixes a few issues with rules_rust/rustc reproducibility when the same code is
+being built in slightly different BuildConfigurations.
+
+Even if BuildConfigurations differ only by insignificant (to rules_rust)
+configuration flags, the resulting output directory will be different (keyed by
+an 'ST-hash' which is generated from the configuration).
+
+Unfortunately, rust/rules_rust really likes to embed bazel-out/<dir>/bin paths
+into the binaries by default, thus embedding the ST-hash, thus leading to
+different bit-for-bit binaries when built across two slightly different
+configs.
+
+We fix this by doing two changes:
+
+ 1. We override the codegen metadata hash suffix to not depend on the ST-hash
+    directory name. Otherwise, built rlibs will have a numeric .XXX suffix that
+    changes depending on the ST-hash. We have to do this separately for prost
+    codegen, too.
+ 2. We add a remap path option to rustc that replaces bazel-out/<dir>/bin/ with
+    bin/.
+---
+ proto/prost/private/prost.bzl | 3 ++-
+ proto/protobuf/proto.bzl      | 2 +-
+ rust/private/clippy.bzl       | 2 +-
+ rust/private/rust.bzl         | 6 +++---
+ rust/private/rustc.bzl        | 4 ++++
+ rust/private/utils.bzl        | 7 +++++--
+ 6 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/proto/prost/private/prost.bzl b/proto/prost/private/prost.bzl
+index 20814500..45b283d9 100644
+--- a/proto/prost/private/prost.bzl
++++ b/proto/prost/private/prost.bzl
+@@ -132,7 +132,8 @@ def _compile_rust(ctx, attr, crate_name, src, deps, edition):
+       A DepVariantInfo provider.
+     """
+     toolchain = ctx.toolchains["@rules_rust//rust:toolchain_type"]
+-    output_hash = repr(hash(src.path + ".prost"))
++    src_path = src.path.replace(ctx.bin_dir.path, 'bin')
++    output_hash = repr(hash(src_path + ".prost"))
+
+     lib_name = "{prefix}{name}-{lib_hash}{extension}".format(
+         prefix = "lib",
+diff --git a/proto/protobuf/proto.bzl b/proto/protobuf/proto.bzl
+index 959d0c1c..00dff5d0 100644
+--- a/proto/protobuf/proto.bzl
++++ b/proto/protobuf/proto.bzl
+@@ -187,7 +187,7 @@ def _rust_proto_compile(protos, descriptor_sets, imports, crate_name, ctx, is_gr
+     srcs.append(lib_rs)
+
+     # And simulate rust_library behavior
+-    output_hash = determine_output_hash(lib_rs, ctx.label)
++    output_hash = determine_output_hash(ctx.bin_dir, lib_rs, ctx.label)
+     rust_lib = ctx.actions.declare_file("%s/lib%s-%s.rlib" % (
+         output_dir,
+         crate_name,
+diff --git a/rust/private/clippy.bzl b/rust/private/clippy.bzl
+index 748f33a0..772b39ad 100644
+--- a/rust/private/clippy.bzl
++++ b/rust/private/clippy.bzl
+@@ -131,7 +131,7 @@ def _clippy_aspect_impl(target, ctx):
+         dep_info = dep_info,
+         linkstamp_outs = linkstamp_outs,
+         ambiguous_libs = ambiguous_libs,
+-        output_hash = determine_output_hash(crate_info.root, ctx.label),
++        output_hash = determine_output_hash(ctx.bin_dir, crate_info.root, ctx.label),
+         rust_flags = [],
+         out_dir = out_dir,
+         build_env_files = build_env_files,
+diff --git a/rust/private/rust.bzl b/rust/private/rust.bzl
+index 21881729..24792e99 100644
+--- a/rust/private/rust.bzl
++++ b/rust/private/rust.bzl
+@@ -159,7 +159,7 @@ def _rust_library_common(ctx, crate_type):
+     if crate_type in ["cdylib", "staticlib"]:
+         output_hash = None
+     else:
+-        output_hash = determine_output_hash(crate_root, ctx.label)
++        output_hash = determine_output_hash(ctx.bin_dir, crate_root, ctx.label)
+
+     rust_lib_name = determine_lib_name(
+         crate_name,
+@@ -316,7 +316,7 @@ def _rust_test_impl(ctx):
+             )
+         else:
+             crate_name = crate.name
+-            output_hash = determine_output_hash(crate.root, ctx.label)
++            output_hash = determine_output_hash(ctx.bin_dir, crate.root, ctx.label)
+             output = ctx.actions.declare_file(
+                 "test-%s/%s%s" % (
+                     output_hash,
+@@ -380,7 +380,7 @@ def _rust_test_impl(ctx):
+                 ctx.label.name + toolchain.binary_ext,
+             )
+         else:
+-            output_hash = determine_output_hash(crate_root, ctx.label)
++            output_hash = determine_output_hash(ctx.bin_dir, crate_root, ctx.label)
+             output = ctx.actions.declare_file(
+                 "test-%s/%s%s" % (
+                     output_hash,
+diff --git a/rust/private/rustc.bzl b/rust/private/rustc.bzl
+index c82c236b..576de4e3 100644
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -973,6 +973,10 @@ def construct_arguments(
+     if remap_path_prefix != None:
+         rustc_flags.add("--remap-path-prefix=${{pwd}}={}".format(remap_path_prefix))
+
++    # Replace unstable bindir path (based on ST-hash which is in turn based on
++    # build configuration) with a stable bin/ path.
++    rustc_flags.add("--remap-path-prefix={}=bin".format(ctx.bin_dir.path))
++
+     emit_without_paths = []
+     for kind in emit:
+         if kind == "link" and crate_info.type == "bin" and crate_info.output != None:
+diff --git a/rust/private/utils.bzl b/rust/private/utils.bzl
+index a0fda352..ff45a149 100644
+--- a/rust/private/utils.bzl
++++ b/rust/private/utils.bzl
+@@ -188,7 +188,7 @@ def abs(value):
+         return -value
+     return value
+
+-def determine_output_hash(crate_root, label):
++def determine_output_hash(bin_dir, crate_root, label):
+     """Generates a hash of the crate root file's path.
+
+     Args:
+@@ -199,8 +199,11 @@ def determine_output_hash(crate_root, label):
+         str: A string representation of the hash.
+     """
+
++    # Remove any unstable BuildConfiguration derived dir fragments to unify
++    # hashes between different configs.
++    crate_root_path = crate_root.path.replace(bin_dir.path, 'bin')
+     # Take the absolute value of hash() since it could be negative.
+-    h = abs(hash(crate_root.path) + hash(repr(label)))
++    h = abs(hash(crate_root_path) + hash(repr(label)))
+     return repr(h)
+
+ def get_preferred_artifact(library_to_link, use_pic):
+--
+2.44.1
+
diff --git a/third_party/rules_rust/rust-uefi-platform.patch b/third_party/rules_rust/rust-uefi-platform.patch
new file mode 100644
index 0000000..e01cf29
--- /dev/null
+++ b/third_party/rules_rust/rust-uefi-platform.patch
@@ -0,0 +1,72 @@
+From b2d165d9b2c811293f92bf083289c97c9d87d13c Mon Sep 17 00:00:00 2001
+From: Lorenz Brun <lorenz@monogon.tech>
+Date: Wed, 25 Sep 2024 02:37:09 +0200
+Subject: [PATCH 1/4] Add support for UEFI targets and OS
+
+---
+ rust/platform/triple_mappings.bzl | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/rust/platform/triple_mappings.bzl b/rust/platform/triple_mappings.bzl
+index 139015da..efa9f167 100644
+--- a/rust/platform/triple_mappings.bzl
++++ b/rust/platform/triple_mappings.bzl
+@@ -47,6 +47,7 @@ SUPPORTED_T2_PLATFORM_TRIPLES = {
+     "aarch64-fuchsia": _support(std = True, host_tools = False),
+     "aarch64-linux-android": _support(std = True, host_tools = False),
+     "aarch64-pc-windows-msvc": _support(std = True, host_tools = True),
++    "aarch64-unknown-uefi": _support(std = True, host_tools = False),
+     "arm-unknown-linux-gnueabi": _support(std = True, host_tools = True),
+     "armv7-linux-androideabi": _support(std = True, host_tools = False),
+     "armv7-unknown-linux-gnueabi": _support(std = True, host_tools = True),
+@@ -65,6 +66,7 @@ SUPPORTED_T2_PLATFORM_TRIPLES = {
+     "x86_64-linux-android": _support(std = True, host_tools = False),
+     "x86_64-unknown-freebsd": _support(std = True, host_tools = True),
+     "x86_64-unknown-none": _support(std = True, host_tools = False),
++    "x86_64-unknown-uefi": _support(std = True, host_tools = False),
+ }
+
+ _T3_PLATFORM_TRIPLES = {
+@@ -142,6 +144,7 @@ _SYSTEM_TO_BUILTIN_SYS_SUFFIX = {
+     "nto": "qnx",
+     "openbsd": "openbsd",
+     "solaris": None,
++    "uefi": "uefi",
+     "unknown": None,
+     "wasi": None,
+     "windows": "windows",
+@@ -160,6 +163,7 @@ _SYSTEM_TO_BINARY_EXT = {
+     "nixos": "",
+     "none": "",
+     "nto": "",
++    "uefi": ".efi",
+     # This is currently a hack allowing us to have the proper
+     # generated extension for the wasm target, similarly to the
+     # windows target
+@@ -181,6 +185,7 @@ _SYSTEM_TO_STATICLIB_EXT = {
+     "nixos": ".a",
+     "none": ".a",
+     "nto": ".a",
++    "uefi": ".lib",
+     "unknown": "",
+     "wasi": "",
+     "windows": ".lib",
+@@ -199,6 +204,7 @@ _SYSTEM_TO_DYLIB_EXT = {
+     "nixos": ".so",
+     "none": ".so",
+     "nto": ".a",
++    "uefi": "", # UEFI doesn't have dynamic linking
+     "unknown": ".wasm",
+     "wasi": ".wasm",
+     "windows": ".dll",
+@@ -244,6 +250,7 @@ _SYSTEM_TO_STDLIB_LINKFLAGS = {
+     "nto": [],
+     "openbsd": ["-lpthread"],
+     "solaris": ["-lsocket", "-lposix4", "-lpthread", "-lresolv"],
++    "uefi": [],
+     "unknown": [],
+     "uwp": ["ws2_32.lib"],
+     "wasi": [],
+--
+2.44.1
+