diff --git a/BUILD b/BUILD
index 29fce8d..a3f5842 100644
--- a/BUILD
+++ b/BUILD
@@ -16,13 +16,6 @@
     visibility = ["//visibility:public"],
 )
 
-# Shortcut for kubectl
-alias(
-    name = "kubectl",
-    actual = "@kubernetes//cmd/kubectl:kubectl",
-    visibility = ["//visibility:public"],
-)
-
 # nogo linters
 nogo(
     name = "nogo_vet",
@@ -85,3 +78,11 @@
     toolchain = ":host_python_pair",
     toolchain_type = "@rules_python//python:toolchain_type",
 )
+
+# Shortcut for kubectl when running through bazel run
+# (don't depend on this, it might turn into an env-based PATH shortcut, use
+# //third_party/kubernetes:kubectl instead)
+alias(
+    name = "kubectl",
+    actual = "//third_party/kubernetes:kubectl",
+)
diff --git a/WORKSPACE b/WORKSPACE
index 3f3598a..e1ae88c 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -90,93 +90,26 @@
 
 protobuf_deps()
 
-# External repository filegroup shortcut
-all_content = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+# third_party external repositories
+load("//third_party/linux:external.bzl", "linux_external")
+linux_external(name="linux", version="5.4.7")
 
-# Linux kernel
+load("//third_party/edk2:external.bzl", "edk2_external")
+edk2_external(name="edk2")
 
-linux_version = "5.4.7"
+load("//third_party/kubernetes:external.bzl", "kubernetes_external")
+kubernetes_external(name="kubernetes", version="1.16.4")
 
-http_archive(
-    name = "linux",
-    build_file = "//third_party/linux/external:BUILD.repo",
-    patch_args = ["-p1"],
-    patches = [
-        # Enable built-in cmdline for efistub
-        "//third_party/linux/external:0001-x86-Allow-built-in-command-line-to-work-in-early-ker.patch",
-    ],
-    sha256 = "abc9b21d9146d95853dac35f4c4489a0199aff53ee6eee4b0563d1b37079fcc9",
-    strip_prefix = "linux-" + linux_version,
-    urls = ["https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-%s.tar.xz" % linux_version],
-)
+load("//third_party/musl:external.bzl", "musl_external")
+musl_external(name="musl", version="1.1.24")
 
-# EDK2
+load("//third_party/util-linux:external.bzl", "util_linux_external")
+util_linux_external(name="util_linux", version="2.34")
 
-# edk2-stable201908
-new_git_repository(
-    name = "edk2",
-    build_file = "//core/build/edk2:BUILD.repo",
-    commit = "37eef91017ad042035090cae46557f9d6e2d5917",
-    init_submodules = True,
-    remote = "https://github.com/tianocore/edk2",
-    shallow_since = "1567048229 +0800",
-)
-
-# musl
-
-musl_version = "1.1.24"
-
-http_archive(
-    name = "musl",
-    build_file_content = all_content,
-    sha256 = "1370c9a812b2cf2a7d92802510cca0058cc37e66a7bedd70051f0a34015022a3",
-    strip_prefix = "musl-" + musl_version,
-    urls = ["https://www.musl-libc.org/releases/musl-%s.tar.gz" % musl_version],
-)
-
-# util-linux
-
-util_linux_version = "2.34"
-
-http_archive(
-    name = "util_linux",
-    build_file_content = all_content,
-    sha256 = "1d0c1a38f8c14a2c251681907203cccc78704f5702f2ef4b438bed08344242f7",
-    strip_prefix = "util-linux-" + util_linux_version,
-    urls = ["https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/snapshot/util-linux-%s.tar.gz" % util_linux_version],
-)
-
-# xfsprogs-dev
-
-xfsprogs_dev_version = "5.2.1"
-
-http_archive(
-    name = "xfsprogs_dev",
-    build_file_content = all_content,
-    patch_args = ["-p1"],
-    patches = [
-        "//core/build/utils/xfsprogs_dev:0001-Fixes-for-static-compilation.patch",
-    ],
-    sha256 = "6187f25f1744d1ecbb028b0ea210ad586d0f2dae24e258e4688c67740cc861ef",
-    strip_prefix = "xfsprogs-dev-" + xfsprogs_dev_version,
-    urls = ["https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/snapshot/xfsprogs-dev-%s.tar.gz" % xfsprogs_dev_version],
-)
-
-# Kubernetes
-k8s_version = "1.16.4"
-
-http_archive(
-    name = "kubernetes",
-    patch_args = ["-p1"],
-    patches = [
-        "//core/build/kubernetes:0001-avoid-unexpected-keyword-error-by-using-positional-p.patch",
-    ],
-    sha256 = "3a49373ba56c73c282deb0cfa2ec7bfcc6bf46acb6992f01319eb703cbf68996",
-    urls = ["https://dl.k8s.io/v%s/kubernetes-src.tar.gz" % k8s_version],
-)
+load("//third_party/xfsprogs:external.bzl", "xfsprogs_external")
+xfsprogs_external(name="xfsprogs", version="5.2.1")
 
 load("@kubernetes//build:workspace_mirror.bzl", "mirror")
-
 http_archive(
     name = "io_k8s_repo_infra",
     sha256 = "f6d65480241ec0fd7a0d01f432938b97d7395aeb8eefbe859bb877c9b4eafa56",
diff --git a/core/BUILD b/core/BUILD
index bd49753..f413b5d 100644
--- a/core/BUILD
+++ b/core/BUILD
@@ -2,8 +2,8 @@
     name = "initramfs",
     srcs = [
         "//core/cmd/init",
-        "//core/build/utils:mkfs.xfs",
         "//core/cmd/kube-controlplane",
+        "//third_party/xfsprogs:mkfs.xfs",
     ],
     outs = [
         "initramfs.cpio.lz4",
@@ -15,7 +15,7 @@
 nod /dev/null 0644 0 0 c 1 3
 file /init $(location //core/cmd/init) 0755 0 0
 dir /bin 0755 0 0
-file /bin/mkfs.xfs $(location //core/build/utils:mkfs.xfs) 0755 0 0
+file /bin/mkfs.xfs $(location //third_party/xfsprogs:mkfs.xfs) 0755 0 0
 file /bin/kube-controlplane $(location //core/cmd/kube-controlplane) 0755 0 0
 EOF
     """,
diff --git a/core/build/kubernetes/BUILD b/core/build/kubernetes/BUILD
deleted file mode 100644
index e69de29..0000000
--- a/core/build/kubernetes/BUILD
+++ /dev/null
diff --git a/core/build/utils/xfsprogs_dev/BUILD b/core/build/utils/xfsprogs_dev/BUILD
deleted file mode 100644
index e69de29..0000000
--- a/core/build/utils/xfsprogs_dev/BUILD
+++ /dev/null
diff --git a/core/scripts/BUILD b/core/scripts/BUILD
index 8e8f18a..28d3aae 100644
--- a/core/scripts/BUILD
+++ b/core/scripts/BUILD
@@ -3,7 +3,7 @@
     data = [
         "//core:image",
         "//core:swtpm_data",
-        "@edk2//:firmware",
+        "//third_party/edk2:firmware",
     ],
 )
 
@@ -17,7 +17,7 @@
     name = "test_deps",
     data = [
         ":launch",
-        "//:kubectl",
+        "//third_party/kubernetes:kubectl",
     ],
 )
 
diff --git a/third_party/edk2/BUILD.bazel b/third_party/edk2/BUILD.bazel
new file mode 100644
index 0000000..8511359
--- /dev/null
+++ b/third_party/edk2/BUILD.bazel
@@ -0,0 +1,5 @@
+alias(
+    name = "firmware",
+    actual = "@edk2//:firmware",
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/edk2/external.bzl b/third_party/edk2/external.bzl
new file mode 100644
index 0000000..6bb7325
--- /dev/null
+++ b/third_party/edk2/external.bzl
@@ -0,0 +1,27 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
+
+def edk2_external(name):
+    new_git_repository(
+        name = name,
+        build_file = "//third_party/edk2/external:BUILD.repo",
+        commit = "37eef91017ad042035090cae46557f9d6e2d5917",
+        init_submodules = True,
+        remote = "https://github.com/tianocore/edk2",
+        shallow_since = "1567048229 +0800",
+    )
diff --git a/core/build/edk2/BUILD b/third_party/edk2/external/BUILD
similarity index 100%
rename from core/build/edk2/BUILD
rename to third_party/edk2/external/BUILD
diff --git a/core/build/edk2/BUILD.repo b/third_party/edk2/external/BUILD.repo
similarity index 100%
rename from core/build/edk2/BUILD.repo
rename to third_party/edk2/external/BUILD.repo
diff --git a/third_party/kubernetes/BUILD.bazel b/third_party/kubernetes/BUILD.bazel
new file mode 100644
index 0000000..4b366ba
--- /dev/null
+++ b/third_party/kubernetes/BUILD.bazel
@@ -0,0 +1,5 @@
+alias(
+    name = "kubectl",
+    actual = "@kubernetes//cmd/kubectl",
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/kubernetes/external.bzl b/third_party/kubernetes/external.bzl
new file mode 100644
index 0000000..77d7af2
--- /dev/null
+++ b/third_party/kubernetes/external.bzl
@@ -0,0 +1,31 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def kubernetes_external(name, version):
+    sums = {
+        "1.16.4": "3a49373ba56c73c282deb0cfa2ec7bfcc6bf46acb6992f01319eb703cbf68996",
+    }
+    http_archive(
+        name = name,
+        patch_args = ["-p1"],
+        patches = [
+            "//third_party/kubernetes/external:0001-avoid-unexpected-keyword-error-by-using-positional-p.patch",
+        ],
+        sha256 = sums[version],
+        urls = ["https://dl.k8s.io/v%s/kubernetes-src.tar.gz" % version],
+    )
diff --git a/core/build/kubernetes/0001-avoid-unexpected-keyword-error-by-using-positional-p.patch b/third_party/kubernetes/external/0001-avoid-unexpected-keyword-error-by-using-positional-p.patch
similarity index 100%
rename from core/build/kubernetes/0001-avoid-unexpected-keyword-error-by-using-positional-p.patch
rename to third_party/kubernetes/external/0001-avoid-unexpected-keyword-error-by-using-positional-p.patch
diff --git a/core/build/edk2/BUILD b/third_party/kubernetes/external/BUILD
similarity index 100%
copy from core/build/edk2/BUILD
copy to third_party/kubernetes/external/BUILD
diff --git a/third_party/linux/external.bzl b/third_party/linux/external.bzl
new file mode 100644
index 0000000..5f25243
--- /dev/null
+++ b/third_party/linux/external.bzl
@@ -0,0 +1,35 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def linux_external(name, version):
+    sums = {
+        "5.4.7": "abc9b21d9146d95853dac35f4c4489a0199aff53ee6eee4b0563d1b37079fcc9",
+    }
+    http_archive(
+        name = name,
+        build_file = "//third_party/linux/external:BUILD.repo",
+        patch_args = ["-p1"],
+        patches = [
+            # Enable built-in cmdline for efistub
+            "//third_party/linux/external:0001-x86-Allow-built-in-command-line-to-work-in-early-ker.patch",
+        ],
+        sha256 = sums[version],
+        strip_prefix = "linux-" + version,
+        urls = ["https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-%s.tar.xz" % version],
+    )
+
diff --git a/core/build/edk2/BUILD b/third_party/musl/BUILD.bazel
similarity index 100%
copy from core/build/edk2/BUILD
copy to third_party/musl/BUILD.bazel
diff --git a/third_party/musl/external.bzl b/third_party/musl/external.bzl
new file mode 100644
index 0000000..b9b4f83
--- /dev/null
+++ b/third_party/musl/external.bzl
@@ -0,0 +1,32 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def musl_external(name, version):
+    sums = {
+        "1.1.24": "1370c9a812b2cf2a7d92802510cca0058cc37e66a7bedd70051f0a34015022a3"
+    }
+    all_content = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+
+    http_archive(
+        name = name,
+        build_file_content = all_content,
+        sha256 = sums[version],
+        strip_prefix = "musl-" + version,
+        urls = ["https://www.musl-libc.org/releases/musl-%s.tar.gz" % version],
+    )
+
diff --git a/core/build/edk2/BUILD b/third_party/util-linux/BUILD.bazel
similarity index 100%
copy from core/build/edk2/BUILD
copy to third_party/util-linux/BUILD.bazel
diff --git a/third_party/util-linux/external.bzl b/third_party/util-linux/external.bzl
new file mode 100644
index 0000000..84b17ec
--- /dev/null
+++ b/third_party/util-linux/external.bzl
@@ -0,0 +1,32 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def util_linux_external(name, version):
+    sums = {
+        "2.34": "1d0c1a38f8c14a2c251681907203cccc78704f5702f2ef4b438bed08344242f7"
+    }
+    all_content = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+
+    http_archive(
+        name = name,
+        build_file_content = all_content,
+        sha256 = sums[version],
+        strip_prefix = "util-linux-" + version,
+        urls = ["https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/snapshot/util-linux-%s.tar.gz" % version],
+    )
+
diff --git a/core/build/utils/BUILD b/third_party/xfsprogs/BUILD
similarity index 94%
rename from core/build/utils/BUILD
rename to third_party/xfsprogs/BUILD
index 9a8dc68..51301b7 100644
--- a/core/build/utils/BUILD
+++ b/third_party/xfsprogs/BUILD
@@ -22,9 +22,9 @@
 #    to how complex the third party build systems we touch are.
 
 genrule(
-    name = "utils",
+    name = "mkfs.extfs",
     srcs = [
-        "@xfsprogs_dev//:all",
+        "@xfsprogs//:all",
         "@musl//:all",
         "@util_linux//:all",
         "@linux//:all",
@@ -73,14 +73,14 @@
 
     echo "Compiling mkfs.xfs..."
     (
-        cd external/xfsprogs_dev
+        cd external/xfsprogs
         make configure
         ./configure CC="$$MUSL/bin/musl-gcc" CFLAGS="-static" --prefix=$$MUSL
         echo COMPILERING
         make mkfs -j8
     ) > /dev/null
 
-    cp external/xfsprogs_dev/mkfs/mkfs.xfs $(RULEDIR)
+    cp external/xfsprogs/mkfs/mkfs.xfs $(RULEDIR)
     """,
     visibility = ["//visibility:public"],
 )
diff --git a/third_party/xfsprogs/external.bzl b/third_party/xfsprogs/external.bzl
new file mode 100644
index 0000000..7318df4
--- /dev/null
+++ b/third_party/xfsprogs/external.bzl
@@ -0,0 +1,35 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def xfsprogs_external(name, version):
+    sums = {
+        "5.2.1": "6187f25f1744d1ecbb028b0ea210ad586d0f2dae24e258e4688c67740cc861ef",
+    }
+    all_content = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+
+    http_archive(
+        name = name,
+        build_file_content = all_content,
+        patch_args = ["-p1"],
+        patches = [
+            "//third_party/xfsprogs/external:0001-Fixes-for-static-compilation.patch",
+        ],
+        sha256 = sums[version],
+        strip_prefix = "xfsprogs-dev-" + version,
+        urls = ["https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/snapshot/xfsprogs-dev-%s.tar.gz" % version],
+    )
diff --git a/core/build/utils/xfsprogs_dev/0001-Fixes-for-static-compilation.patch b/third_party/xfsprogs/external/0001-Fixes-for-static-compilation.patch
similarity index 100%
rename from core/build/utils/xfsprogs_dev/0001-Fixes-for-static-compilation.patch
rename to third_party/xfsprogs/external/0001-Fixes-for-static-compilation.patch
diff --git a/core/build/edk2/BUILD b/third_party/xfsprogs/external/BUILD
similarity index 100%
copy from core/build/edk2/BUILD
copy to third_party/xfsprogs/external/BUILD