diff --git a/WORKSPACE b/WORKSPACE
index 4ccbb9e..5462219 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -209,6 +209,13 @@
     version = "1.2.55",
 )
 
+load("//third_party/gnuefi:external.bzl", "gnuefi_external")
+
+gnuefi_external(
+    name = "gnuefi",
+    version = "3.0.14",
+)
+
 register_toolchains("//:host_python")
 
 # python dependencies. Currently we don't use Python, but some of our deps (ie. gvisor) do expect @pydeps// to exist, even
diff --git a/third_party/gnuefi/BUILD b/third_party/gnuefi/BUILD
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/gnuefi/BUILD
diff --git a/third_party/gnuefi/external.bzl b/third_party/gnuefi/external.bzl
new file mode 100644
index 0000000..e9e9351
--- /dev/null
+++ b/third_party/gnuefi/external.bzl
@@ -0,0 +1,14 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def gnuefi_external(name, version):
+    sums = {
+        "3.0.14": "b73b643a0d5697d1f396d7431448e886dd805668789578e3e1a28277c9528435",
+    }
+
+    http_archive(
+        name = name,
+        sha256 = sums[version],
+        build_file = "@//third_party/gnuefi:gnuefi.bzl",
+        strip_prefix = "gnu-efi-%s" % version,
+        urls = ["https://netix.dl.sourceforge.net/project/gnu-efi/gnu-efi-%s.tar.bz2" % version],
+    )
diff --git a/third_party/gnuefi/gnuefi.bzl b/third_party/gnuefi/gnuefi.bzl
new file mode 100644
index 0000000..adb3a82
--- /dev/null
+++ b/third_party/gnuefi/gnuefi.bzl
@@ -0,0 +1,10 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+cc_library(
+    name = "gnuefi",
+    srcs = glob(["lib/*.c", "lib/runtime/*.c", "lib/x86_64/*.c"]),
+    hdrs = glob(["inc/**/*.h"]),
+    # Consumers expect this to be a system library, so add it to the transitive include paths
+    includes = ["inc", "inc/x86_64"],
+    visibility = ["//visibility:public"],
+)