diff --git a/third_party/seccomp/external.bzl b/third_party/seccomp/external.bzl
index 66f933b..7f558c6 100644
--- a/third_party/seccomp/external.bzl
+++ b/third_party/seccomp/external.bzl
@@ -17,6 +17,8 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 def seccomp_external(name, version):
+    # NOTE: Remember to update seccomp.bzl's seccomp.h template rule
+    # with the correct version.
     sums = {
         "2.5.1": "76ad54e31d143b39a99083564045212a965e026a1010a742edd793d26d699829",
     }
diff --git a/third_party/seccomp/seccomp.bzl b/third_party/seccomp/seccomp.bzl
index 6b0a9aa..4280fc2 100644
--- a/third_party/seccomp/seccomp.bzl
+++ b/third_party/seccomp/seccomp.bzl
@@ -53,11 +53,11 @@
     name = "seccomp.h",
     src = "include/seccomp.h.in",
     substitutions = {
-        # Irrelevant for Bazel. Just look at WORKSPACE.
-        # Make it obviously invalid so nobody is mislead.
-        "@VERSION_MAJOR@": "0",
-        "@VERSION_MINOR@": "0",
-        "@VERSION_MICRO@": "0",
+        # Known dependencies relying on this version information:
+        # - @com_github_seccomp_libseccomp_golang//:libseccomp-golang
+        "@VERSION_MAJOR@": "2",
+        "@VERSION_MINOR@": "5",
+        "@VERSION_MICRO@": "1",
     },
     visibility = ["//visibility:public"],
 )