diff --git a/.bazelrc b/.bazelrc
index 0af5b3f..1dcf729 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -87,6 +87,10 @@
 #     prevent stackoverflows for gvisor
 build:dbg --@io_bazel_rules_go//go/config:tags=selinux,seccomp,no_zfs,no_aufs,no_devicemapper,providerless,dockerless,nowasm,netgo,osusergo,nobtrfs,nozfs,notapestats,norapl,kvm_debug
 
+# Run race config with race detector
+build:race --@io_bazel_rules_go//go/config:race
+build:race --@io_bazel_rules_go//go/config:tags=selinux,seccomp,no_zfs,no_aufs,no_devicemapper,providerless,dockerless,nowasm,netgo,osusergo,nobtrfs,nozfs,notapestats,norapl,race
+
 # Build with C++17.
 build --cxxopt=-std=c++17
 
diff --git a/build/ci/jenkins-presubmit.groovy b/build/ci/jenkins-presubmit.groovy
index 8701c3e..861e967 100644
--- a/build/ci/jenkins-presubmit.groovy
+++ b/build/ci/jenkins-presubmit.groovy
@@ -27,6 +27,7 @@
                         sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci build  --//metropolis/cli/metroctl:buildkind=lite --platforms=@io_bazel_rules_go//go/toolchain:windows_arm64 //metropolis/cli/metroctl"
                         sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci build  --//metropolis/cli/metroctl:buildkind=lite --platforms=@io_bazel_rules_go//go/toolchain:windows_amd64 //metropolis/cli/metroctl"
                         sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci test --config dbg //..."
+                        sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci test --config race //..."
                     }
                     post {
                         success {
diff --git a/metropolis/cli/takeover/BUILD.bazel b/metropolis/cli/takeover/BUILD.bazel
index d43d307..08f4f19 100644
--- a/metropolis/cli/takeover/BUILD.bazel
+++ b/metropolis/cli/takeover/BUILD.bazel
@@ -1,6 +1,5 @@
 load("@aspect_bazel_lib//lib:transitions.bzl", "platform_transition_binary")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
 load("//osbase/build:def.bzl", "node_initramfs")
 
 node_initramfs(
@@ -52,7 +51,6 @@
 go_binary(
     name = "takeover_bin",
     embed = [":takeover_lib"],
-    pure = "on",
     visibility = ["//visibility:public"],
 )
 
diff --git a/metropolis/node/core/BUILD.bazel b/metropolis/node/core/BUILD.bazel
index b7d10af..4f15dea 100644
--- a/metropolis/node/core/BUILD.bazel
+++ b/metropolis/node/core/BUILD.bazel
@@ -61,6 +61,5 @@
 go_binary(
     name = "core",
     embed = [":core_lib"],
-    pure = "on",  # keep
     visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/node/core/network/dhcp4c/BUILD.bazel b/metropolis/node/core/network/dhcp4c/BUILD.bazel
index 24dbe83..34f2a23 100644
--- a/metropolis/node/core/network/dhcp4c/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/BUILD.bazel
@@ -29,7 +29,6 @@
         "lease_test.go",
     ],
     embed = [":dhcp4c"],
-    pure = "on",
     deps = [
         "//metropolis/node/core/network/dhcp4c/transport",
         "@com_github_cenkalti_backoff_v4//:backoff",
diff --git a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
index 2091f6b..b6659ba 100644
--- a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
@@ -22,7 +22,6 @@
     name = "callback_test",
     srcs = ["callback_test.go"],
     embed = [":callback"],
-    pure = "on",
     deps = [
         "//metropolis/node/core/network/dhcp4c",
         "@com_github_google_go_cmp//cmp",
diff --git a/metropolis/node/kubernetes/hyperkube/BUILD.bazel b/metropolis/node/kubernetes/hyperkube/BUILD.bazel
index 3c4e31b..406ec7d 100644
--- a/metropolis/node/kubernetes/hyperkube/BUILD.bazel
+++ b/metropolis/node/kubernetes/hyperkube/BUILD.bazel
@@ -1,5 +1,5 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 load("@//third_party/go:kubernetes_version_def.bzl", "version_x_defs")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
     name = "hyperkube_lib",
@@ -21,7 +21,6 @@
 go_binary(
     name = "hyperkube",
     embed = [":hyperkube_lib"],
-    pure = "on",
     visibility = ["//metropolis/node:__pkg__"],
     x_defs = version_x_defs(),
 )
diff --git a/metropolis/test/e2e/httpserver/BUILD.bazel b/metropolis/test/e2e/httpserver/BUILD.bazel
index 9370eeb..d32e3de 100644
--- a/metropolis/test/e2e/httpserver/BUILD.bazel
+++ b/metropolis/test/e2e/httpserver/BUILD.bazel
@@ -12,7 +12,6 @@
 go_binary(
     name = "httpserver",
     embed = [":httpserver_lib"],
-    pure = "on",
     visibility = ["//visibility:private"],
 )
 
diff --git a/metropolis/test/e2e/persistentvolume/BUILD.bazel b/metropolis/test/e2e/persistentvolume/BUILD.bazel
index cf0917e..7c97c21 100644
--- a/metropolis/test/e2e/persistentvolume/BUILD.bazel
+++ b/metropolis/test/e2e/persistentvolume/BUILD.bazel
@@ -16,7 +16,6 @@
 go_binary(
     name = "persistentvolume",
     embed = [":persistentvolume_lib"],
-    pure = "on",
     visibility = ["//visibility:private"],
 )
 
diff --git a/metropolis/test/e2e/preseedtest/BUILD.bazel b/metropolis/test/e2e/preseedtest/BUILD.bazel
index 68f5717..ad43f78 100644
--- a/metropolis/test/e2e/preseedtest/BUILD.bazel
+++ b/metropolis/test/e2e/preseedtest/BUILD.bazel
@@ -12,7 +12,6 @@
 go_binary(
     name = "preseedtest",
     embed = [":preseedtest_lib"],
-    pure = "on",
     visibility = ["//visibility:private"],
 )
 
diff --git a/metropolis/test/e2e/selftest/BUILD.bazel b/metropolis/test/e2e/selftest/BUILD.bazel
index 23445a0..31754d6 100644
--- a/metropolis/test/e2e/selftest/BUILD.bazel
+++ b/metropolis/test/e2e/selftest/BUILD.bazel
@@ -12,7 +12,6 @@
 go_binary(
     name = "selftest",
     embed = [":selftest_lib"],
-    pure = "on",
     visibility = ["//visibility:private"],
 )
 
diff --git a/metropolis/test/nanoswitch/BUILD.bazel b/metropolis/test/nanoswitch/BUILD.bazel
index 323d53e..8e246ba 100644
--- a/metropolis/test/nanoswitch/BUILD.bazel
+++ b/metropolis/test/nanoswitch/BUILD.bazel
@@ -29,7 +29,6 @@
 go_binary(
     name = "nanoswitch",
     embed = [":nanoswitch_lib"],
-    pure = "on",
     visibility = ["//visibility:private"],
 )
 
diff --git a/osbase/build/def.bzl b/osbase/build/def.bzl
index b2dfe91..24f2af7 100644
--- a/osbase/build/def.bzl
+++ b/osbase/build/def.bzl
@@ -19,12 +19,13 @@
     """
     Transition that enables pure, static build of Go binaries.
     """
-    race = settings['@io_bazel_rules_go//go/config:race']
+    race = settings["@io_bazel_rules_go//go/config:race"]
     pure = not race
 
     return {
         "@io_bazel_rules_go//go/config:pure": pure,
         "@io_bazel_rules_go//go/config:static": True,
+        "//command_line_option:platforms": "//build/platforms:linux_amd64_static",
     }
 
 build_pure_transition = transition(
@@ -35,6 +36,7 @@
     outputs = [
         "@io_bazel_rules_go//go/config:pure",
         "@io_bazel_rules_go//go/config:static",
+        "//command_line_option:platforms",
     ],
 )
 
diff --git a/osbase/erofs/BUILD.bazel b/osbase/erofs/BUILD.bazel
index 596b428..d48eb1f 100644
--- a/osbase/erofs/BUILD.bazel
+++ b/osbase/erofs/BUILD.bazel
@@ -23,7 +23,6 @@
         "erofs_test.go",
     ],
     embed = [":erofs"],
-    pure = "on",  # keep
     deps = [
         "@com_github_stretchr_testify//assert",
         "@com_github_stretchr_testify//require",
diff --git a/osbase/fsquota/BUILD.bazel b/osbase/fsquota/BUILD.bazel
index 350f33d..7c62fd7 100644
--- a/osbase/fsquota/BUILD.bazel
+++ b/osbase/fsquota/BUILD.bazel
@@ -17,7 +17,6 @@
     name = "fsquota_test",
     srcs = ["fsquota_test.go"],
     embed = [":fsquota"],
-    pure = "on",
     deps = [
         "@com_github_stretchr_testify//require",
         "@org_golang_x_sys//unix",
diff --git a/osbase/test/ktest/BUILD.bazel b/osbase/test/ktest/BUILD.bazel
index 733d695..0a43ab4 100644
--- a/osbase/test/ktest/BUILD.bazel
+++ b/osbase/test/ktest/BUILD.bazel
@@ -13,7 +13,6 @@
 go_binary(
     name = "ktest",
     embed = [":ktest_lib"],
-    pure = "on",
     visibility = [
         "//go/net/psample:__pkg__",
         "//metropolis:__subpackages__",
diff --git a/osbase/test/ktest/init/BUILD.bazel b/osbase/test/ktest/init/BUILD.bazel
index 56b262c..ec34d49 100644
--- a/osbase/test/ktest/init/BUILD.bazel
+++ b/osbase/test/ktest/init/BUILD.bazel
@@ -11,7 +11,6 @@
 go_binary(
     name = "init",
     embed = [":init_lib"],
-    pure = "on",
     visibility = [
         "//visibility:public",
     ],