diff --git a/build/fietsje/fietsje.bash.in b/build/fietsje/fietsje.bash.in
new file mode 100644
index 0000000..bad5f8e
--- /dev/null
+++ b/build/fietsje/fietsje.bash.in
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Most of this comes from github.com/bazelbuild/bazel-gazelle/internal/gazelle.bash.in.
+# It's very hacky.
+
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FIETSJE_SHORT_PATH=@@FIETSJE_SHORT_PATH@@
+GOTOOL=@@GOTOOL@@
+
+# find_runfile prints the location of a runfile in the source workspace,
+# either by reading the symbolic link or reading the runfiles manifest.
+function find_runfile {
+  local runfile=$1
+  if [ -f "$runfile" ]; then
+    readlink "$runfile"
+    return
+  fi
+  runfile=$(echo "$runfile" | sed -e 's!^\(\.\./\|external/\)!!')
+  if grep -q "^$runfile" MANIFEST; then
+    grep "^$runfile" MANIFEST | head -n 1 | cut -d' ' -f2
+    return
+  fi
+  # printing nothing indicates failure
+}
+
+# bazel_build_get_path builds a given target and prints the absolute path
+# to the generated binary. This only works for rules that produce a single file.
+function bazel_build_get_path {
+  local build_log=$(mktemp fietsje_build.XXXX.json --tmpdir)
+  bazel build --build_event_json_file="$build_log" "$1"
+  grep "^{\"id\":{\"targetCompleted\":{\"label\":\"$1\"" "$build_log" | \
+    sed -e 's!^.*file://\([^"]*\).*$!\1!'
+  rm -f "$build_log"
+}
+
+# set_goroot attempts to set GOROOT to the SDK used by rules_go. fietsje
+# invokes tools inside the Go SDK for dependency management. It's good to
+# use the SDK used by the workspace in case the Go SDK is not installed
+# on the host system or is a different version.
+function set_goroot {
+  local gotool=$(find_runfile "$GOTOOL")
+  if [ -z "$gotool" ]; then
+    echo "$0: warning: could not locate GOROOT used by rules_go" >&2
+    return
+  fi
+  export GOROOT=$(cd "$(dirname "$gotool")/.."; pwd)
+  if type cygpath >/dev/null 2>&1; then
+    # On Windows, convert the path to something usable outside of bash.
+    GOROOT=$(cygpath -w "$GOROOT")
+  fi
+}
+
+set_goroot
+fietsje_short_path=$(find_runfile "$FIETSJE_SHORT_PATH")
+if [ -z "$fietsje_short_path" ]; then
+  echo "error: could not locate fietsje binary" >&2
+  exit 1
+fi
+if [ -z "${BUILD_WORKSPACE_DIRECTORY-}" ]; then
+  echo "error: BUILD_WORKSPACE_DIRECOTRY not set" >&2
+  exit 1
+fi
+cd "$BUILD_WORKSPACE_DIRECTORY"
+"$fietsje_short_path" -shelf_path third_party/go/shelf.pb.text -repositories_bzl third_party/go/repositories.bzl