diff --git a/BUILD b/BUILD
index 99080be..29fce8d 100644
--- a/BUILD
+++ b/BUILD
@@ -57,3 +57,31 @@
         "@org_golang_x_tools//go/analysis/passes/unusedresult:go_tool_library",
     ],
 )
+
+load("@rules_python//python:defs.bzl", "py_runtime_pair")
+
+# Python toolchains - just use the host python for now.
+# TODO(T649): move to external (nix?) interpreters.
+py_runtime(
+    name = "host_python3",
+    interpreter_path = "/usr/bin/python3",
+    python_version = "PY3",
+)
+
+py_runtime(
+    name = "host_python2",
+    interpreter_path = "/usr/bin/python2",
+    python_version = "PY2",
+)
+
+py_runtime_pair(
+    name = "host_python_pair",
+    py2_runtime = ":host_python2",
+    py3_runtime = ":host_python3",
+)
+
+toolchain(
+    name = "host_python",
+    toolchain = ":host_python_pair",
+    toolchain_type = "@rules_python//python:toolchain_type",
+)
diff --git a/WORKSPACE b/WORKSPACE
index 62796fb..3f3598a 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -183,3 +183,5 @@
     strip_prefix = "repo-infra-9f4571ad7242bf3ec4b47365062498c2528f9a5f",
     urls = mirror("https://github.com/kubernetes/repo-infra/archive/9f4571ad7242bf3ec4b47365062498c2528f9a5f.tar.gz"),
 )
+
+register_toolchains("//:host_python")
diff --git a/build/Dockerfile b/build/Dockerfile
index e07e60d..7332d90 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -32,7 +32,8 @@
 	postgresql \
 	expect \
 	grpc-cli \
-	nc
+	nc \
+	python-unversioned-command
 
 # Workaround for a binutils bugs in F30, which generates invalid ELF binaries
 # when linking statically with musl.