diff --git a/MODULE.bazel b/MODULE.bazel
index 4ba0610..a4f20d1 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -97,6 +97,8 @@
 register_toolchains("@rust_toolchains//:all")
 
 # Protobuf Toolchains
+register_toolchains("//build/toolchain/protobuf:protoc_sources_toolchain")
+
 register_toolchains("@rules_rust_protobuf//:default_proto_toolchain")
 
 register_toolchains("//build/toolchain/rust-efi:prost_efi_toolchain")
diff --git a/build/toolchain/protobuf/BUILD.bazel b/build/toolchain/protobuf/BUILD.bazel
new file mode 100644
index 0000000..19caf61
--- /dev/null
+++ b/build/toolchain/protobuf/BUILD.bazel
@@ -0,0 +1,17 @@
+load("@protobuf//bazel/toolchains:proto_toolchain.bzl", "proto_toolchain")
+load(":def.bzl", "ignore_unused_configuration_target")
+
+ignore_unused_configuration_target(
+    name = "protoc",
+    dep = "@protobuf//:protoc",
+    visibility = ["//visibility:private"],
+)
+
+# This is a copy of the toolchain defined at
+# @protobuf//bazel/private/toolchains:protoc_sources_toolchain, but with unused
+# configurations reset, such that we build protoc only once.
+proto_toolchain(
+    name = "protoc_sources",
+    exec_compatible_with = [],
+    proto_compiler = ":protoc",
+)
diff --git a/build/toolchain/protobuf/def.bzl b/build/toolchain/protobuf/def.bzl
new file mode 100644
index 0000000..ea6a9b5
--- /dev/null
+++ b/build/toolchain/protobuf/def.bzl
@@ -0,0 +1,34 @@
+load("//osbase/build:def.bzl", "forward_impl")
+
+# This is a copy of ignore_unused_configuration_target from
+# //osbase/build:def.bzl with specific settings for the protobuf toolchain.
+_new_settings = {
+    "@io_bazel_rules_go//go/config:race": False,
+    "@io_bazel_rules_go//go/config:pure": False,
+    "@io_bazel_rules_go//go/config:static": False,
+    "@io_bazel_rules_go//go/config:tags": [],
+
+    # These private configs show up because of a bug in rules_go, which is
+    # missing a non_go_tool_transition on the proto toolchain when
+    # --incompatible_enable_proto_toolchain_resolution is enabled.
+    "@io_bazel_rules_go//go/private/rules:original_pure": "",
+    "@io_bazel_rules_go//go/private/rules:original_tags": "",
+}
+
+def _ignore_unused_configuration_impl(_settings, _attr):
+    return _new_settings
+
+_ignore_unused_configuration = transition(
+    implementation = _ignore_unused_configuration_impl,
+    inputs = [],
+    outputs = list(_new_settings.keys()),
+)
+
+ignore_unused_configuration_target = rule(
+    cfg = _ignore_unused_configuration,
+    implementation = forward_impl,
+    attrs = {
+        "dep": attr.label(mandatory = True),
+    },
+    doc = """Applies ignore_unused_configuration transition to a target.""",
+)
diff --git a/osbase/build/def.bzl b/osbase/build/def.bzl
index d9be587..b047d8b 100644
--- a/osbase/build/def.bzl
+++ b/osbase/build/def.bzl
@@ -18,7 +18,7 @@
     ],
 )
 
-def _forward_impl(ctx):
+def forward_impl(ctx):
     # We can't pass DefaultInfo through as-is, since Bazel forbids executable
     # if it's a file declared in a different target. To emulate that, symlink
     # to the original executable, if there is one.
@@ -46,7 +46,7 @@
 
 build_static_target = rule(
     cfg = build_static_transition,
-    implementation = _forward_impl,
+    implementation = forward_impl,
     attrs = {
         "dep": attr.label(mandatory = True),
     },
@@ -89,7 +89,7 @@
 
 ignore_unused_configuration_target = rule(
     cfg = ignore_unused_configuration,
-    implementation = _forward_impl,
+    implementation = forward_impl,
     attrs = {
         "dep": attr.label(mandatory = True),
     },