diff --git a/cloud/agent/install.go b/cloud/agent/install.go
index 0693595..a59664e 100644
--- a/cloud/agent/install.go
+++ b/cloud/agent/install.go
@@ -27,7 +27,7 @@
 	"source.monogon.dev/osbase/supervisor"
 )
 
-//go:embed metropolis/node/core/abloader/abloader.efi
+//go:embed metropolis/node/core/abloader/abloader_bin.efi
 var abloader []byte
 
 // install dispatches OSInstallationRequests to the appropriate installer
diff --git a/metropolis/cli/takeover/install.go b/metropolis/cli/takeover/install.go
index 5bea9e9..8c1ad79 100644
--- a/metropolis/cli/takeover/install.go
+++ b/metropolis/cli/takeover/install.go
@@ -18,7 +18,7 @@
 	"source.monogon.dev/osbase/structfs"
 )
 
-//go:embed metropolis/node/core/abloader/abloader.efi
+//go:embed metropolis/node/core/abloader/abloader_bin.efi
 var abloader []byte
 
 // EnvInstallTarget environment variable which tells the takeover binary where
diff --git a/metropolis/installer/main.go b/metropolis/installer/main.go
index 2ba2142..ad0fa30 100644
--- a/metropolis/installer/main.go
+++ b/metropolis/installer/main.go
@@ -29,7 +29,7 @@
 	"source.monogon.dev/osbase/sysfs"
 )
 
-//go:embed metropolis/node/core/abloader/abloader.efi
+//go:embed metropolis/node/core/abloader/abloader_bin.efi
 var abloader []byte
 
 const mib = 1024 * 1024
diff --git a/metropolis/node/core/abloader/BUILD.bazel b/metropolis/node/core/abloader/BUILD.bazel
index ee7b69f..de47b00 100644
--- a/metropolis/node/core/abloader/BUILD.bazel
+++ b/metropolis/node/core/abloader/BUILD.bazel
@@ -1,14 +1,15 @@
 load("@rules_rust//rust:defs.bzl", "rust_binary")
+load("//osbase/build:def.bzl", "ignore_unused_configuration_target")
 
 rust_binary(
-    name = "abloader",
+    name = "abloader_bin",
     srcs = ["main.rs"],
     edition = "2021",
     platform = "//build/platforms:efi_amd64",
     target_compatible_with = [
         "@platforms//os:uefi",
     ],
-    visibility = ["//visibility:public"],
+    visibility = ["//visibility:private"],
     deps = [
         "//metropolis/node/core/abloader/spec:abloader_proto_rs",
         "@crate_index_efi//:prost",
@@ -16,3 +17,9 @@
         "@crate_index_efi//:uefi-services",
     ],
 )
+
+ignore_unused_configuration_target(
+    name = "abloader",
+    dep = ":abloader_bin",
+    visibility = ["//visibility:public"],
+)
diff --git a/metropolis/node/core/update/update.go b/metropolis/node/core/update/update.go
index 48f778d..f241e05 100644
--- a/metropolis/node/core/update/update.go
+++ b/metropolis/node/core/update/update.go
@@ -425,7 +425,7 @@
 	return nil
 }
 
-//go:embed metropolis/node/core/abloader/abloader.efi
+//go:embed metropolis/node/core/abloader/abloader_bin.efi
 var abloader []byte
 
 func (s *Service) fixupPreloader() error {
diff --git a/osbase/build/def.bzl b/osbase/build/def.bzl
index f1665b5..d9be587 100644
--- a/osbase/build/def.bzl
+++ b/osbase/build/def.bzl
@@ -86,3 +86,12 @@
     inputs = [],
     outputs = list(_new_settings.keys()),
 )
+
+ignore_unused_configuration_target = rule(
+    cfg = ignore_unused_configuration,
+    implementation = _forward_impl,
+    attrs = {
+        "dep": attr.label(mandatory = True),
+    },
+    doc = """Applies ignore_unused_configuration transition to a target.""",
+)