diff --git a/third_party/chrony/BUILD.bazel b/third_party/chrony/BUILD.bazel
index 700f7de..e69de29 100644
--- a/third_party/chrony/BUILD.bazel
+++ b/third_party/chrony/BUILD.bazel
@@ -1 +0,0 @@
-exports_files(["config.h.in"])
diff --git a/third_party/chrony/chrony.bzl b/third_party/chrony/chrony.bzl
index 812d536..f72c059 100644
--- a/third_party/chrony/chrony.bzl
+++ b/third_party/chrony/chrony.bzl
@@ -1,9 +1,39 @@
-load("@@//build/utils:template_file.bzl", "template_file")
+load("@bazel_skylib//rules:expand_template.bzl", "expand_template")
+load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 
-template_file(
-    name = "config.h",
-    src = "@@//third_party/chrony:config.h.in",
+write_file(
+    name = "config.h_template",
+    out = "config.h.in",
+    content = ["""\
+#define LINUX
+#define DEBUG 0
+#define USE_PTHREAD_ASYNCDNS
+
+#define CHRONY_VERSION "%CHRONY_VERSION%"
+#define CHRONYD_FEATURES "NTP RTC SCFILTER ASYNCDNS"
+#define FEAT_NTP
+#define FEAT_RTC
+#define FEAT_SCFILTER
+#define FEAT_ASYNCDNS
+#define FEAT_PRIVDROP
+#define CAP_IS_SUPPORTED
+
+#define DEFAULT_COMMAND_SOCKET "/todo/chronyd.sock"
+#define DEFAULT_CONF_FILE "/todo/chrony.conf"
+#define DEFAULT_HWCLOCK_FILE ""
+#define DEFAULT_PID_FILE "/todo/chronyd.pid"
+#define DEFAULT_RTC_DEVICE "/dev/rtc"
+#define DEFAULT_USER "root"
+
+#define MAIL_PROGRAM "/todo/sendmail"
+"""],
+)
+
+expand_template(
+    name = "config.h_expanded",
+    template = ":config.h.in",
+    out = "config.h",
     substitutions = {
         # ONCHANGE(//build/bazel:third_party.MODULE.bazel): version needs to be kept in sync
         "%CHRONY_VERSION%": "4.1-monogon",
@@ -14,7 +44,7 @@
 cc_library(
     name = "common_hdrs",
     srcs = [
-        ":config.h",
+        ":config.h_expanded",
 
         # Headers corresponding to .c files in :common.
         "addrfilt.h",
diff --git a/third_party/chrony/config.h.in b/third_party/chrony/config.h.in
deleted file mode 100644
index 09694b3..0000000
--- a/third_party/chrony/config.h.in
+++ /dev/null
@@ -1,21 +0,0 @@
-#define LINUX
-#define DEBUG 0
-#define USE_PTHREAD_ASYNCDNS
-
-#define CHRONY_VERSION "%CHRONY_VERSION%"
-#define CHRONYD_FEATURES "NTP RTC SCFILTER ASYNCDNS"
-#define FEAT_NTP
-#define FEAT_RTC
-#define FEAT_SCFILTER
-#define FEAT_ASYNCDNS
-#define FEAT_PRIVDROP
-#define CAP_IS_SUPPORTED
-
-#define DEFAULT_COMMAND_SOCKET "/todo/chronyd.sock"
-#define DEFAULT_CONF_FILE "/todo/chrony.conf"
-#define DEFAULT_HWCLOCK_FILE ""
-#define DEFAULT_PID_FILE "/todo/chronyd.pid"
-#define DEFAULT_RTC_DEVICE "/dev/rtc"
-#define DEFAULT_USER "root"
-
-#define MAIL_PROGRAM "/todo/sendmail"