diff --git a/build/bazel/go.MODULE.bazel b/build/bazel/go.MODULE.bazel
index d3104eb..66d09cf 100644
--- a/build/bazel/go.MODULE.bazel
+++ b/build/bazel/go.MODULE.bazel
@@ -8,6 +8,12 @@
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//:go.mod")
 
+inject_repo(
+    go_deps,
+    "libpg_query",
+    "seccomp",
+)
+
 # All *direct* Go dependencies of the module have to be listed explicitly.
 # This list can be automatically updated by running "bazel mod tidy".
 use_repo(
diff --git a/third_party/BUILD.bazel b/third_party/BUILD.bazel
index 7a1c6c1..2146c53 100644
--- a/third_party/BUILD.bazel
+++ b/third_party/BUILD.bazel
@@ -17,16 +17,3 @@
     },
     visibility = ["//visibility:public"],
 )
-
-# TODO: Workaround for https://github.com/bazelbuild/bazel/issues/19301
-alias(
-    name = "zlib",
-    actual = "@zlib",
-    visibility = ["//visibility:public"],
-)
-
-alias(
-    name = "zstd",
-    actual = "@zstd//:zstd",
-    visibility = ["//visibility:public"],
-)
diff --git a/third_party/chrony/BUILD.bazel b/third_party/chrony/BUILD.bazel
index 700f7de..e69de29 100644
--- a/third_party/chrony/BUILD.bazel
+++ b/third_party/chrony/BUILD.bazel
@@ -1 +0,0 @@
-exports_files(["config.h.in"])
diff --git a/third_party/chrony/chrony.bzl b/third_party/chrony/chrony.bzl
index 812d536..f72c059 100644
--- a/third_party/chrony/chrony.bzl
+++ b/third_party/chrony/chrony.bzl
@@ -1,9 +1,39 @@
-load("@@//build/utils:template_file.bzl", "template_file")
+load("@bazel_skylib//rules:expand_template.bzl", "expand_template")
+load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 
-template_file(
-    name = "config.h",
-    src = "@@//third_party/chrony:config.h.in",
+write_file(
+    name = "config.h_template",
+    out = "config.h.in",
+    content = ["""\
+#define LINUX
+#define DEBUG 0
+#define USE_PTHREAD_ASYNCDNS
+
+#define CHRONY_VERSION "%CHRONY_VERSION%"
+#define CHRONYD_FEATURES "NTP RTC SCFILTER ASYNCDNS"
+#define FEAT_NTP
+#define FEAT_RTC
+#define FEAT_SCFILTER
+#define FEAT_ASYNCDNS
+#define FEAT_PRIVDROP
+#define CAP_IS_SUPPORTED
+
+#define DEFAULT_COMMAND_SOCKET "/todo/chronyd.sock"
+#define DEFAULT_CONF_FILE "/todo/chrony.conf"
+#define DEFAULT_HWCLOCK_FILE ""
+#define DEFAULT_PID_FILE "/todo/chronyd.pid"
+#define DEFAULT_RTC_DEVICE "/dev/rtc"
+#define DEFAULT_USER "root"
+
+#define MAIL_PROGRAM "/todo/sendmail"
+"""],
+)
+
+expand_template(
+    name = "config.h_expanded",
+    template = ":config.h.in",
+    out = "config.h",
     substitutions = {
         # ONCHANGE(//build/bazel:third_party.MODULE.bazel): version needs to be kept in sync
         "%CHRONY_VERSION%": "4.1-monogon",
@@ -14,7 +44,7 @@
 cc_library(
     name = "common_hdrs",
     srcs = [
-        ":config.h",
+        ":config.h_expanded",
 
         # Headers corresponding to .c files in :common.
         "addrfilt.h",
diff --git a/third_party/chrony/config.h.in b/third_party/chrony/config.h.in
deleted file mode 100644
index 09694b3..0000000
--- a/third_party/chrony/config.h.in
+++ /dev/null
@@ -1,21 +0,0 @@
-#define LINUX
-#define DEBUG 0
-#define USE_PTHREAD_ASYNCDNS
-
-#define CHRONY_VERSION "%CHRONY_VERSION%"
-#define CHRONYD_FEATURES "NTP RTC SCFILTER ASYNCDNS"
-#define FEAT_NTP
-#define FEAT_RTC
-#define FEAT_SCFILTER
-#define FEAT_ASYNCDNS
-#define FEAT_PRIVDROP
-#define CAP_IS_SUPPORTED
-
-#define DEFAULT_COMMAND_SOCKET "/todo/chronyd.sock"
-#define DEFAULT_CONF_FILE "/todo/chrony.conf"
-#define DEFAULT_HWCLOCK_FILE ""
-#define DEFAULT_PID_FILE "/todo/chronyd.pid"
-#define DEFAULT_RTC_DEVICE "/dev/rtc"
-#define DEFAULT_USER "root"
-
-#define MAIL_PROGRAM "/todo/sendmail"
diff --git a/third_party/com_github_opencontainers_runc/runc-add-cdeps.patch b/third_party/com_github_opencontainers_runc/runc-add-cdeps.patch
index e980f59..fd15c15 100644
--- a/third_party/com_github_opencontainers_runc/runc-add-cdeps.patch
+++ b/third_party/com_github_opencontainers_runc/runc-add-cdeps.patch
@@ -4,7 +4,7 @@
          "enosys_unsupported.go",
      ],
      cgo = True,
-+    cdeps = ["@@//third_party/seccomp"],
++    cdeps = ["@seccomp"],
      importpath = "github.com/opencontainers/runc/libcontainer/seccomp/patchbpf",
      visibility = ["//visibility:public"],
      deps = select({
diff --git a/third_party/com_github_pganalyze_pg_query_go_v4/pganalyze-add-cdeps.patch b/third_party/com_github_pganalyze_pg_query_go_v4/pganalyze-add-cdeps.patch
index a73adff..3ace09d 100644
--- a/third_party/com_github_pganalyze_pg_query_go_v4/pganalyze-add-cdeps.patch
+++ b/third_party/com_github_pganalyze_pg_query_go_v4/pganalyze-add-cdeps.patch
@@ -5,7 +5,7 @@
      ],
      cgo = True,
 +    cdeps = [
-+        "@@//third_party/libpg_query",
++        "@libpg_query",
 +    ],
      clinkopts = [""],
      copts = ["-Iparser/include -g -fstack-protector -std=gnu99 -Wno-deprecated-non-prototype -Wno-unknown-warning-option"],
diff --git a/third_party/com_github_seccomp_libseccomp_golang/libseccomp.patch b/third_party/com_github_seccomp_libseccomp_golang/libseccomp.patch
index 6779c5d..27de7d5 100644
--- a/third_party/com_github_seccomp_libseccomp_golang/libseccomp.patch
+++ b/third_party/com_github_seccomp_libseccomp_golang/libseccomp.patch
@@ -5,7 +5,7 @@
          "seccomp_internal.go",
      ],
 +    cdeps = [
-+        "@@//third_party/seccomp",
++        "@seccomp",
 +    ],
      cgo = True,
      importpath = "github.com/seccomp/libseccomp-golang",
diff --git a/third_party/glib/BUILD.bazel b/third_party/glib/BUILD.bazel
index 6ad9477..e69de29 100644
--- a/third_party/glib/BUILD.bazel
+++ b/third_party/glib/BUILD.bazel
@@ -1,6 +0,0 @@
-# TODO: Workaround for https://github.com/bazelbuild/bazel/issues/19301
-alias(
-    name = "glib",
-    actual = "@glib//glib",
-    visibility = ["//visibility:public"],
-)
diff --git a/third_party/libpg_query/BUILD.bazel b/third_party/libpg_query/BUILD.bazel
index 4e4c14e..e69de29 100644
--- a/third_party/libpg_query/BUILD.bazel
+++ b/third_party/libpg_query/BUILD.bazel
@@ -1,6 +0,0 @@
-# TODO: Workaround for https://github.com/bazelbuild/bazel/issues/19301
-alias(
-    name = "libpg_query",
-    actual = "@libpg_query//:libpg_query",
-    visibility = ["//visibility:public"],
-)
diff --git a/third_party/libpg_query/libpg_query.bzl b/third_party/libpg_query/libpg_query.bzl
index c77c692..83207ea 100644
--- a/third_party/libpg_query/libpg_query.bzl
+++ b/third_party/libpg_query/libpg_query.bzl
@@ -57,6 +57,6 @@
         "-Iexternal/libpg_query/vendor/xxhash",
     ],
     visibility = [
-        "@//third_party/libpg_query:__pkg__",
+        "//visibility:public",
     ],
 )
diff --git a/third_party/libtpms/BUILD.bazel b/third_party/libtpms/BUILD.bazel
index 6bbc4eb..e69de29 100644
--- a/third_party/libtpms/BUILD.bazel
+++ b/third_party/libtpms/BUILD.bazel
@@ -1,6 +0,0 @@
-# TODO: Workaround for https://github.com/bazelbuild/bazel/issues/19301
-alias(
-    name = "libtpms_tpm2",
-    actual = "@libtpms//:libtpms_tpm2",
-    visibility = ["//visibility:public"],
-)
diff --git a/third_party/seccomp/BUILD.bazel b/third_party/seccomp/BUILD.bazel
index 1f619ad..e69de29 100644
--- a/third_party/seccomp/BUILD.bazel
+++ b/third_party/seccomp/BUILD.bazel
@@ -1,6 +0,0 @@
-# TODO: Workaround for https://github.com/bazelbuild/bazel/issues/19301
-alias(
-    name = "seccomp",
-    actual = "@seccomp",
-    visibility = ["//visibility:public"],
-)
diff --git a/third_party/swtpm/patches/0004-bazel-support-implement.patch b/third_party/swtpm/patches/0004-bazel-support-implement.patch
index b37ea69..d51922f 100644
--- a/third_party/swtpm/patches/0004-bazel-support-implement.patch
+++ b/third_party/swtpm/patches/0004-bazel-support-implement.patch
@@ -53,8 +53,8 @@
 +cc_binary(
 +    name = "swtpm",
 +    deps = [
-+        "@@//third_party/libtpms:libtpms_tpm2",
-+        "@@//third_party/glib",
++        "@libtpms//:libtpms_tpm2",
++        "@glib//glib",
 +    ],
 +    srcs = glob([
 +        "src/swtpm/*.h",
@@ -82,8 +82,8 @@
 +cc_binary(
 +    name = "swtpm_localca",
 +    deps = [
-+        "@@//third_party/libtpms:libtpms_tpm2",
-+        "@@//third_party/glib",
++        "@libtpms//:libtpms_tpm2",
++        "@glib//glib",
 +    ],
 +    srcs = glob([
 +        "src/swtpm_localca/*.h",
@@ -106,8 +106,8 @@
 +cc_binary(
 +    name = "swtpm_setup",
 +    deps = [
-+        "@@//third_party/libtpms:libtpms_tpm2",
-+        "@@//third_party/glib",
++        "@libtpms//:libtpms_tpm2",
++        "@glib//glib",
 +    ],
 +    srcs = glob([
 +        "src/swtpm_setup/*.h",
diff --git a/third_party/urcu/urcu.bzl b/third_party/urcu/urcu.bzl
index 57307f1..351611d 100644
--- a/third_party/urcu/urcu.bzl
+++ b/third_party/urcu/urcu.bzl
@@ -3,7 +3,7 @@
 
 template_file(
     name = "config.h",
-    src = "@@//third_party/urcu:config.h.in",
+    src = ":config.h.in",
     substitutions = {},
 )