diff --git a/build/bazel/go.MODULE.bazel b/build/bazel/go.MODULE.bazel
index 120f4c8..eb4aea5 100644
--- a/build/bazel/go.MODULE.bazel
+++ b/build/bazel/go.MODULE.bazel
@@ -161,6 +161,8 @@
     "github.com/opencontainers/runc": {
         "directives": [
             "gazelle:build_tags seccomp",
+            # Make @com_github_opencontainers_runc//:runc_lib visible
+            "gazelle:go_visibility //visibility:public",
         ],
         "patches": [
             "//third_party/com_github_opencontainers_runc:runc-add-cdeps.patch",
@@ -178,6 +180,8 @@
         "directives": [
             "gazelle:proto disable",
             "gazelle:build_tags nowasm",
+            # Make @com_github_sqlc_dev_sqlc//cmd/sqlc:sqlc_lib visible
+            "gazelle:go_visibility //visibility:public",
         ],
     },
     "github.com/containerd/ttrpc": {
diff --git a/build/go/BUILD.bazel b/build/go/BUILD.bazel
deleted file mode 100644
index e69de29..0000000
--- a/build/go/BUILD.bazel
+++ /dev/null
diff --git a/build/go/def.bzl b/build/go/def.bzl
deleted file mode 100644
index c696564..0000000
--- a/build/go/def.bzl
+++ /dev/null
@@ -1,67 +0,0 @@
-load("@bazel_skylib//lib:paths.bzl", "paths")
-
-def _build_with_tag_transition_impl(settings, attr):
-    """
-    Transition that enables pure, static build of Go binaries.
-    """
-    tags = settings["@io_bazel_rules_go//go/config:tags"]
-
-    return {
-        "@io_bazel_rules_go//go/config:tags": tags + attr.gotags,
-    }
-
-build_with_tag_transition = transition(
-    implementation = _build_with_tag_transition_impl,
-    inputs = [
-        "@io_bazel_rules_go//go/config:tags",
-    ],
-    outputs = [
-        "@io_bazel_rules_go//go/config:tags",
-    ],
-)
-
-def _go_binary_with_tag_impl(ctx):
-    # We need to forward the DefaultInfo provider from the underlying rule.
-    # Unfortunately, we can't do this directly, because Bazel requires that the executable to run
-    # is actually generated by this rule, so we need to symlink to it, and generate a synthetic
-    # forwarding DefaultInfo.
-
-    result = []
-    binary = ctx.attr.binary[0]
-
-    default_info = binary[DefaultInfo]
-    new_executable = None
-    original_executable = default_info.files_to_run.executable
-
-    if not original_executable:
-        fail("Cannot transition a 'binary' that is not executable")
-
-    # In order for the symlink to have the same basename as the original
-    # executable (important in the case of proto plugins), put it in a
-    # subdirectory named after the label to prevent collisions.
-    new_executable = ctx.actions.declare_file(paths.join(ctx.label.name, original_executable.basename))
-    ctx.actions.symlink(
-        output = new_executable,
-        target_file = original_executable,
-        is_executable = True,
-    )
-
-    result.append(
-        DefaultInfo(
-            files = depset(direct = [new_executable]),
-            executable = new_executable,
-        ),
-    )
-
-    return result
-
-go_binary_with_tag = rule(
-    implementation = _go_binary_with_tag_impl,
-    attrs = {
-        "binary": attr.label(
-            mandatory = True,
-            cfg = build_with_tag_transition,
-        ),
-        "gotags": attr.string_list(),
-    },
-)
diff --git a/build/sqlc/BUILD.bazel b/build/sqlc/BUILD.bazel
index 63fd6ff..22fbb6a 100644
--- a/build/sqlc/BUILD.bazel
+++ b/build/sqlc/BUILD.bazel
@@ -1,7 +1,12 @@
-load("//build/go:def.bzl", "go_binary_with_tag")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-go_binary_with_tag(
+# keep
+go_binary(
     name = "sqlc",
-    binary = "@com_github_sqlc_dev_sqlc//cmd/sqlc",
-    gotags = ["nowasm"],
+    embed = ["@com_github_sqlc_dev_sqlc//cmd/sqlc:sqlc_lib"],
+    gotags = [
+        "osusergo",
+        "netgo",
+        "nowasm",
+    ],
 )
diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 231456a..a7e9f9a 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -1,6 +1,5 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
 load("@rules_pkg//:pkg.bzl", "pkg_zip")
-load("//build/go:def.bzl", "go_binary_with_tag")
 load("//osbase/build/genosrelease:defs.bzl", "os_release")
 load("//osbase/build/mkerofs:def.bzl", "erofs_image")
 load("//osbase/build/mkimage:def.bzl", "node_image")
@@ -38,10 +37,14 @@
     "passwd",
 ])
 
-go_binary_with_tag(
+go_binary(
     name = "runc",
-    binary = "@com_github_opencontainers_runc//:runc",
-    gotags = ["seccomp"],
+    embed = ["@com_github_opencontainers_runc//:runc_lib"],
+    gotags = [
+        "osusergo",
+        "netgo",
+        "seccomp",
+    ],
 )
 
 erofs_image(