diff --git a/build/toolchain/musl-host-gcc/BUILD b/build/toolchain/musl-host-gcc/BUILD
index 656bb45..5b83901 100644
--- a/build/toolchain/musl-host-gcc/BUILD
+++ b/build/toolchain/musl-host-gcc/BUILD
@@ -1,23 +1,18 @@
 load("//build/toolchain:cc_toolchain_config.bzl", "host_cc_toolchain_config")
 
-# This file defines //build/toolchain/musl-host-gcc:musl_host_cc_suite.
+# This file defines //build/toolchain/musl-host-gcc:musl_host_toolchain.
 #
-# This is a C++ toolchain that uses GCC from the host at hardcoded paths, with
+# This is a C++ toolchain that uses GCC from the sandbox sysroot at hardcoded paths, with
 # a pre-built sysroot tarball that targets Metropolis nodes with musl and Linux
-# headers.  It's a superset of //build/toolchain:host_cc_suite.
+# headers.  It's a superset of //build/toolchain:host_cc_toolchain.
+#
 # For more information, see README.md.
 
-cc_toolchain_suite(
-    name = "musl_host_cc_suite",
-    toolchains = {
-        "k8": ":musl_host_cc_k8_toolchain",
-    },
-    visibility = ["//visibility:public"],
-)
-
 cc_toolchain(
     name = "musl_host_cc_k8_toolchain",
     all_files = ":musl_toolchain_files",
+    ar_files = ":musl_toolchain_files",
+    as_files = ":musl_toolchain_files",
     compiler_files = ":musl_toolchain_files",
     dwp_files = ":musl_toolchain_files",
     linker_files = ":musl_toolchain_files",
@@ -45,3 +40,18 @@
         "@musl_sysroot//:all",
     ],
 )
+
+toolchain(
+    name = "musl_host_toolchain",
+    exec_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
+    ],
+    target_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
+        "//build/platforms/linkmode:musl-static",
+    ],
+    toolchain = ":musl_host_cc_k8_toolchain",
+    toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
+)
diff --git a/build/toolchain/musl-host-gcc/README.md b/build/toolchain/musl-host-gcc/README.md
index 367b4a7..a5e9222 100644
--- a/build/toolchain/musl-host-gcc/README.md
+++ b/build/toolchain/musl-host-gcc/README.md
@@ -1,20 +1,21 @@
 musl-host-gcc
 =============
 
-musl-host-gcc is a Bazel C++ toolchain that uses the machine's host gcc in combination with a pre-built musl, musl headers, and Linux headers.
+musl-host-gcc is a Bazel C++ toolchain that uses the sandbox sysroot gcc in combination with a pre-built musl, musl headers, and Linux headers.
 
 It is currently used to build the few C binaries we need on Metropolis nodes.
 
-At some point, this toolchain should be replaced by a fully hermetic toolchain that doesn't depend on the host environment.
+At some point, this toolchain should be improved to directly consume a static compiler toolchain and sysroot, so we can eventually get rid of the sandbox (like Aspect's [gcc-toolchain](https://github.com/aspect-build/gcc-toolchain) is doing).
 
 Usage
 -----
 
 To use this toolchain explicitly while building a `cc_binary`, do:
 
-    bazel build --crosstool_top=//build/toolchain/musl-host-gcc:musl_host_cc_suite //foo/bar
+    bazel build --platforms=//build/platforms:linux_amd64_static //foo/bar
 
-During an actual build however, the right toolchain should be selected using aspects or other Bazel configurability features, instead of a hardcoded `--crosstool_top`.
+During an actual build however, the right toolchain should be selected using transitions
+or other configuration mechanisms.
 
 Building Toolchain Sysroot Tarball
 ----------------------------------
@@ -36,7 +37,7 @@
 1. `//build/toolchain/musl-host-gcc/sysroot` is used to build `//build/toolchain/musl-host-gcc/sysroot.tar.xz` which is a tarball that contains all include and binary library files for building against musl for Metropolis nodes (x86\_64 / k8) - these are musl headers, musl libraries, and linux headers. This tarball is committed to source control.
 1. When building a target that uses the toolchain, the `sysroot.tar.xz` tarball is extracted into an external repository `@musl_sysroot`, via `sysroot.bzl` and `sysroot_repository.bzl`.
 1. A toolchain config is built using `//build/toolchain:cc_toolchain_config.bzl`, which points at `gcc-wrapper.sh` as its gcc entrypoint. `gcc-wrapper.sh` expects to be able to call the host gcc with `musl.spec`.
-1. A toolchain is built in `//build/toolchain/musl-host-gcc:musl_host_cc_suite`, which uses the previously mentioned config, and builds it to contain `gcc-wrapper.sh`, `musl.spec`, and the sysroot tarball.
+1. A toolchain is defined in `//build/toolchain/musl-host-gcc:musl_host_toolchain` with a `//build/platforms/linkmode:musl-static` constraint, which is selected by the `//build/platforms:linux_amd64_static` platform.
 
 Quirks
 ------