diff --git a/.github/workflows/lre.yaml b/.github/workflows/lre.yaml
index a9229cc12..765cf0842 100644
--- a/.github/workflows/lre.yaml
+++ b/.github/workflows/lre.yaml
@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-24.04, macos-26]
-        toolchain: [lre-cc, lre-rs]
+        toolchain: [lre-cc]
         exclude:
           - os: macos-26
             toolchain: lre-cc
@@ -70,211 +70,57 @@ jobs:
         with:
           nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
 
-#   remote:
-#     strategy:
-#       fail-fast: false
-#       matrix:
-#         os: [xlarge-ubuntu-24.04]
-#         toolchain: [lre-cc, lre-rs]
-#     name: Remote / ${{ matrix.toolchain }} / ${{ matrix.os }}
-#     runs-on: ${{ matrix.os }}
-#     timeout-minutes: 45
-#     steps:
-#       - name: Checkout
-#         uses: >- # v6.0.2
-#           actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-
-#       - name: Prepare Worker
-#         uses: ./.github/actions/prepare-nix
-#         with:
-#           nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
-
-#       - name: Start Kubernetes cluster
-#         run: >
-#           nix run .#native up
-
-#       - name: Start NativeLink operator
-#         env:
-#           REPO_URL: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }}
-#           BRANCH: ${{ github.event.pull_request.head.ref || github.ref_name }}
-#           COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: |
-#           nix develop --impure --command bash -c 'cat > kustomization.yaml << EOF
-#           apiVersion: kustomize.config.k8s.io/v1beta1
-#           kind: Kustomization
-#           resources:
-#           - kubernetes/resources/flux
-#           - kubernetes/resources/nativelink-core
-#           - kubernetes/resources/gateway-routes
-#           - kubernetes/workers/resources/worker-init
-#           - kubernetes/workers/resources/${TOOLCHAIN}
-#           patches:
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/url
-#                 value: ${REPO_URL}
-#               - op: replace
-#                 path: /spec/ref/branch
-#                 value: ${BRANCH}
-#               - op: replace
-#                 path: /spec/ref/commit
-#                 value: ${COMMIT}
-#             target:
-#               kind: GitRepository
-#               name: nativelink-infra
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/postBuild/substitute/PLACEHOLDER_FLAKE_OUTPUT
-#                 value: ./src_root#image
-#             target:
-#               kind: Kustomization
-#               name: nativelink-alert-core
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/postBuild/substitute/PLACEHOLDER_FLAKE_OUTPUT
-#                 value: ./src_root#nativelink-worker-init
-#             target:
-#               kind: Kustomization
-#               name: nativelink-alert-worker-init
-#           - patch: |-
-#               - op: replace
-#                 path: /spec/postBuild/substitute/PLACEHOLDER_FLAKE_OUTPUT
-#                 value: ./src_root#nativelink-worker-${TOOLCHAIN}
-#             target:
-#               kind: Kustomization
-#               name: nativelink-alert-${TOOLCHAIN}
-#           EOF
-#           kubectl apply -k . &&
-#           rm kustomization.yaml'
-
-#       - name: Wait for Tekton resources
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-tekton-resources"
-
-#       - name: Wait for alerts
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-alert-core && \
-#           flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-alert-worker-init && \
-#           flux reconcile kustomization \
-#             --timeout=15m \
-#             nativelink-alert-${TOOLCHAIN}"
-
-#       - name: Trigger pipelines
-#         env:
-#           REPO_URL: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }}
-#           BRANCH: ${{ github.event.pull_request.head.ref || github.ref_name }}
-#         run: |
-#           nix develop --impure --command bash -c 'cat > nativelink-repo.yaml << EOF
-#           apiVersion: source.toolkit.fluxcd.io/v1
-#           kind: GitRepository
-#           metadata:
-#             name: nativelink
-#             namespace: default
-#           spec:
-#             interval: 2m
-#             url: ${REPO_URL}
-#             ref:
-#               branch: ${BRANCH}
-#           EOF
-#           kubectl apply -f nativelink-repo.yaml &&
-#           rm nativelink-repo.yaml'
-
-#       - name: Wait for Tekton pipelines
-#         run: >
-#           nix develop --impure --command bash << 'EOF'
-#             until pr=$(kubectl get pipelinerun -n ci -o name | \
-#                        grep rebuild-nativelink-run-); do
-#               echo "Waiting for pipeline to be created..."
-#               sleep 1
-#             done
-
-#             echo "Found pipelinerun: $pr"
-#             kubectl wait --for=create -n ci $pr
-
-#             echo "Waiting for pipelinerun to succeed..."
-#             kubectl wait \
-#               --for=condition=Succeeded \
-#               --timeout=45m \
-#               pipelinerun \
-#               -n ci \
-#               -l tekton.dev/pipeline=rebuild-nativelink
-#           EOF
-
-#       - name: Wait for NativeLink Kustomization
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization -n default \
-#             --timeout=15m \
-#             nativelink-core"
-
-#       - name: Debug Kustomizations
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl get kustomizations.kustomize.toolkit.fluxcd.io -A && kubectl events --all-namespaces && kubectl describe kustomizations.kustomize.toolkit.fluxcd.io -A"
-#         if: always()
-
-#       - name: Wait for Worker Kustomization
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "flux reconcile kustomization -n default \
-#             --timeout=15m \
-#             nativelink-${TOOLCHAIN}"
-
-#       - name: Debug Kustomizations
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl get kustomizations.kustomize.toolkit.fluxcd.io -A && kubectl events --all-namespaces && kubectl describe kustomizations.kustomize.toolkit.fluxcd.io -A"
-#         if: always()
-
-#       - name: Wait for NativeLink
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl rollout status deploy/nativelink"
-
-#       - name: Wait for worker
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "kubectl rollout status deploy/nativelink-worker-${TOOLCHAIN}"
-
-#       - name: Get gateway IPs
-#         id: gateway-ips
-#         run: |
-#           echo "nativelink_ip=$(kubectl get gtw nativelink-gateway -o=jsonpath='{.status.addresses[0].value}')" >> "$GITHUB_ENV"
-
-#       - name: Print cluster state
-#         run: |
-#           kubectl get svc -A
-#           kubectl get pod -A
-#           kubectl get svc -A
-#           kubectl get deployments -A
-#           kubectl describe gtw
-#           echo "nativelink"
-#           kubectl logs -l app=nativelink
-#           echo "worker"
-#           kubectl logs -l app=nativelink-worker
-
-#       - name: Build example with ${{ matrix.toolchain }} toolchain
-#         env:
-#           TOOLCHAIN: ${{ matrix.toolchain }}
-#         run: >
-#           nix develop --impure --command
-#           bash -c "bazel run \
-#             --remote_cache=grpc://$nativelink_ip \
-#             --remote_executor=grpc://$nativelink_ip \
-#             --verbose_failures \
-#             @local-remote-execution//examples:${TOOLCHAIN}"
+  remote-docker-compose:
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout
+      uses: >- # v6.0.2
+        actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+    - name: Set up Docker Buildx
+      uses: >- # v3.9.0
+        docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca
+
+    - name: Prepare Worker
+      uses: ./.github/actions/prepare-nix
+      with:
+        nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
+
+    - name: Build Nativelink images
+      run: |
+        nix run .#image.copyTo docker-daemon:local-nativelink:latest
+        nix run .#nativelink-worker-lre-cc.copyTo docker-daemon:local-worker-cc:latest
+        nix run .#nativelink-worker-init.copyTo docker-daemon:local-worker-init:latest
+
+    - name: Compile NativeLink with NativeLink
+      timeout-minutes: 5 # FIXME: Reset to 60 before merge
+      run: |
+        set -eu
+        mkdir .cache
+        ls -l .cache
+        chmod 777 .cache
+        ls -l .cache
+        cd deployment-examples/docker-compose
+        (docker compose -f docker-compose-lre.yml up 2>&1 | tee -i docker-compose.log) &
+        cd ../../
+        nix develop --impure --fallback --command \
+        bash -c "bazel test //... \
+           --lockfile_mode=error \
+           --verbose_failures \
+           --config self_test --config self_execute"
+      env:
+          NATIVELINK_IMAGE: local-nativelink:latest
+          NATIVELINK_WORKER_INIT_IMAGE: local-worker-init:latest
+          NATIVELINK_LRE_IMAGE: local-worker-cc:latest
+          NATIVELINK_DIR: ${{ github.workspace }}/.cache
+          RUST_LOG: debug
+
+    - name: Check Docker compose
+      run: cat deployment-examples/docker-compose/docker-compose.log
+      if: always()
+
+    - name: Teardown Worker
+      uses: ./.github/actions/end-nix
+      if: always()
+      with:
+        nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 2fa5d424d..1992b609f 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -20,72 +20,6 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
-  # TODO(palfrey): Flaky. Fix.
-  # docker-compose-compiles-nativelink:
-  #   # The type of runner that the job will run on.
-  #   runs-on: ubuntu-24.04
-  #   strategy:
-  #     matrix:
-  #       # Which OS versions we will test on.
-  #       os_version: [ 24.04 ]
-  #   steps:
-  #   - name: Checkout
-  #     uses: >- # v6.0.2
-  #       actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-
-  #   - name: Set up Docker Buildx
-  #     uses: >- # v3.9.0
-  #       docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca
-
-  #   - name: Build Nativelink image
-  #     uses: >- # v6.13.0
-  #       docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991
-  #     with:
-  #       context: .
-  #       file: ./deployment-examples/docker-compose/Dockerfile
-  #       build-args: |
-  #         OPT_LEVEL=opt
-  #         OS_VERSION=${{ matrix.os_version }}
-  #         ADDITIONAL_SETUP_WORKER_CMD=apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y gcc g++ lld pkg-config python3
-  #       load: true # This brings the build into `docker images` from buildx.
-  #       tags: trace_machina/nativelink:latest
-
-  #   - name: Build builder image
-  #     uses: >- # v6.13.0
-  #       docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991
-  #     with:
-  #       context: .
-  #       file: ./deployment-examples/docker-compose/Dockerfile
-  #       build-args: |
-  #         OPT_LEVEL=opt
-  #         OS_VERSION=${{ matrix.os_version }}
-  #       load: true # This brings the build into `docker images` from buildx.
-  #       tags: trace_machina/nativelink:builder
-  #       target: builder
-
-  #   - name: Compile NativeLink with NativeLink
-  #     run: |
-  #       mkdir -p ~/.cache && \
-  #       cd deployment-examples/docker-compose && \
-  #       (docker-compose up -d || docker compose up -d) && \
-  #       cd ../../ && \
-  #       docker run --rm --net=host -w /root/nativelink -v $PWD:/root/nativelink trace_machina/nativelink:builder sh -c ' \
-  #         bazel clean && \
-  #         bazel test //... \
-  #         --extra_toolchains=@rust_toolchains//:all \
-  #         --remote_cache=grpc://127.0.0.1:50051 \
-  #         --remote_executor=grpc://127.0.0.1:50052 \
-  #         --remote_default_exec_properties=cpu_count=2 \
-  #       ' && \
-  #       docker run --rm --net=host -w /root/nativelink -v $PWD:/root/nativelink trace_machina/nativelink:builder sh -c ' \
-  #         bazel clean && \
-  #         bazel test //... \
-  #         --extra_toolchains=@rust_toolchains//:all \
-  #         --remote_cache=grpc://127.0.0.1:50051 \
-  #         --remote_executor=grpc://127.0.0.1:50052 \
-  #         --remote_default_exec_properties=cpu_count=2 \
-  #       ' 2>&1 | ( ! grep '         PASSED in ' ) # If we get PASSED without (cache) it means there's a cache issue.
-
   integration-tests:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
diff --git a/MODULE.bazel b/MODULE.bazel
index e6f269e54..95a8724c6 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,7 +1,6 @@
 module(
     name = "nativelink",
     version = "1.6.3",
-    compatibility_level = 0,
 )
 
 bazel_dep(name = "rules_cc", version = "0.2.19")
@@ -102,11 +101,12 @@ crate.from_cargo(
         "x86_64-apple-darwin",
         "x86_64-pc-windows-msvc",
         "x86_64-unknown-linux-gnu",
+        "x86_64-unknown-linux-musl",
     ],
     # The LRE Rust toolchains in //local-remote-execution/rust still register
     # against @rules_rust//rust:toolchain_type, so crate_universe must render
     # selects against legacy @rules_rust//rust/platform:* labels.
-    use_legacy_rules_rust_platforms = True,
+    # use_legacy_rules_rust_platforms = True,
 )
 crate.annotation(
     crate = "zstd-sys",
@@ -114,16 +114,6 @@ crate.annotation(
 )
 use_repo(crate, "crates")
 
-# NativeLink uses Local Remote Execution for Rust by default which automatically
-# handles Rust toolchain configuration via Nix.
-#
-# If you build outside of Nix you'll have to register these toolchains
-# explicitly by passing `--extra_toolchains=@rust_toolchains//:all` to your
-# Bazel invocation.
-#
-# WARNING: This configuration exists entirely as a convenience option and
-#          migration and is not a supported way of building production
-#          grade nativelink executables. It may be removed at any point in time.
 rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
 rust.toolchain(
     edition = "2024",
@@ -134,24 +124,24 @@ rust.toolchain(
     sha256s = {
         # Update the shas with update-module-hashes
         # BEGIN SHAS
-        "2026-03-24/cargo-nightly-x86_64-unknown-linux-gnu.tar.xz": "952622b3830be1cd0cc06544972d9b9cbea361bb1a155e5aacf88102dfc5b9bf",
-        "2026-03-24/clippy-nightly-x86_64-unknown-linux-gnu.tar.xz": "c7e66ea9a6d6a5b9af6f55b24f7709874e06c43a9cacb5d68d30b960ecbab230",
-        "2026-03-24/llvm-tools-nightly-x86_64-unknown-linux-gnu.tar.xz": "50a82652bad87dcae1b08127e888991d514b018851c3378b862752155e29b3ec",
-        "2026-03-24/rust-std-nightly-x86_64-unknown-linux-gnu.tar.xz": "5c0c15c08c9e727d3544c521aa48168bd32b24ef9eec814bae5786b5194f31bf",
+        "2026-03-24/cargo-nightly-x86_64-unknown-linux-musl.tar.xz": "9fab9d83ccb8c76653bda776cc838f42feba4003a7c3d7d2a610a073c179602a",
+        "2026-03-24/clippy-nightly-x86_64-unknown-linux-musl.tar.xz": "53be2469c18a0ad6df68cc9a7f0cde801e3e295090034ed702be3c5e0f73c817",
+        "2026-03-24/llvm-tools-nightly-x86_64-unknown-linux-musl.tar.xz": "baf11bf996d6d696fad9fbb4b434ae2d9bf354c7709938ecbc3a40ff5dd1880c",
+        "2026-03-24/rust-std-nightly-x86_64-unknown-linux-musl.tar.xz": "e2af41c6200f34b6dfac118856b3df8202e422ad1bfeefdc6c29f2554c896b8d",
         "2026-03-24/rustc-nightly-aarch64-apple-darwin.tar.xz": "9310535abcfe2b1b86e4e8a1e6455e622ad5435a5281a6133aa7e6aa0bd4aa3d",
-        "2026-03-24/rustc-nightly-x86_64-unknown-linux-gnu.tar.xz": "7183776faefeb29ca430ee91f49a157491e82ce5ef158f082b3876648bba0406",
+        "2026-03-24/rustc-nightly-x86_64-unknown-linux-musl.tar.xz": "2b13f1f6bef919ec3a3ee3117220708ef921673f4fcfbb47b1339fe8586eb9fe",
         "2026-03-24/rustfmt-nightly-aarch64-apple-darwin.tar.xz": "3f989cd84234158dfe240571ec18441bfb586d9fcc4c06036a766a705ea6a69b",
-        "2026-03-24/rustfmt-nightly-x86_64-unknown-linux-gnu.tar.xz": "0eeef38fe72a1a718b19256cd1e5f92c96ee9d39eb6b9324f2514a674f1e4308",
+        "2026-03-24/rustfmt-nightly-x86_64-unknown-linux-musl.tar.xz": "bb1a31ca91c86f4fc1a48f6a8253cdf1dab8f070c9851be2d5b68a1733be98b3",
         "cargo-1.93.1-aarch64-apple-darwin.tar.xz": "ecd50b093656061366c5af1184af10d883f21bddb482a9c2142fe860c0f671b2",
-        "cargo-1.93.1-x86_64-unknown-linux-gnu.tar.xz": "dbf12e8fd2a245a6bdd9f6c8df267cb2c25b0c56866ee91d8321337df0a00ddb",
+        "cargo-1.93.1-x86_64-unknown-linux-musl.tar.xz": "2b2e987bee5d83416374b8dbe9e660c05344ed47287eb789877dd43a2ed2e122",
         "clippy-1.93.1-aarch64-apple-darwin.tar.xz": "33d57654b0f19360cc4deecbaf248586f89ce9d345df2d54ee8d5541cf7c9f95",
-        "clippy-1.93.1-x86_64-unknown-linux-gnu.tar.xz": "60c0ce83ecc1700de724404a928c30d096c178a610c6707d4f06cee25284cc02",
+        "clippy-1.93.1-x86_64-unknown-linux-musl.tar.xz": "a97898b7f203e368a2781dc58c0a11356af0ac18345591b660daf87c3a1c13c0",
         "llvm-tools-1.93.1-aarch64-apple-darwin.tar.xz": "d61834568e6e591db13ad235e09c3c65e2f10c099c29bfd8eec018f6c9f55462",
-        "llvm-tools-1.93.1-x86_64-unknown-linux-gnu.tar.xz": "f32c5405d7765ffd18554e01f59eff1db32e22813a529425f4ad8903722b594e",
+        "llvm-tools-1.93.1-x86_64-unknown-linux-musl.tar.xz": "b176b03e1b846d5dabb99df4f619ec2637aee00fb2e3b3d256e219bd3adcb038",
         "rust-std-1.93.1-aarch64-apple-darwin.tar.xz": "dd278e6eb993ddffb190442ca11ed1e118c1edaf04114910e3c8c652f6423f65",
-        "rust-std-1.93.1-x86_64-unknown-linux-gnu.tar.xz": "82c4e41268f1741e4eb68796aeb6ca5042406ae858dd56144155c4ef8d87d8b6",
+        "rust-std-1.93.1-x86_64-unknown-linux-musl.tar.xz": "24a9592c81c3def623f9e33e90f8f5bacefbffdd59d87f52da542fd6f4b252df",
         "rustc-1.93.1-aarch64-apple-darwin.tar.xz": "d103a0ee04c121b30cf061c7ad1456daaebd7ff0a7ea5fdb64acf92d86cb25fd",
-        "rustc-1.93.1-x86_64-unknown-linux-gnu.tar.xz": "b9db2636f5a101c4cdaf46a26f8a0c8e4b5767ecdb02ae9c7ccc3ead577732bc",
+        "rustc-1.93.1-x86_64-unknown-linux-musl.tar.xz": "426193ee15a56d973b910c84a3ba1a1c2a66413f1917feaf9a7d8c0cceb56ebb",
         # END SHAS
     },
     versions = [
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index 0235798ee..f27c667be 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -258,7 +258,7 @@
     },
     "@@local-remote-execution+//rust:extension.bzl%lre_rs": {
       "general": {
-        "bzlTransitiveDigest": "uG+JZDxQyPELNihTm54EkV+15PXyp8wI4w/Peu5bXa4=",
+        "bzlTransitiveDigest": "g5qLaV3nAPJBZGj1ErGnN9pqV7sQT3XZ4/N7tQa3iyY=",
         "usagesDigest": "R9P8gnprFTJ/SsXLiQE5qx+Sqsa8YOFAOmRUyDO3tLY=",
         "recordedInputs": [
           "REPO_MAPPING:local-remote-execution+,bazel_tools bazel_tools"
@@ -319,6 +319,20 @@
               "build_file": "@@local-remote-execution+//rust:x86_64-linux.BUILD.bazel",
               "path": "/nix/store/5pysp36qjzbwdjx9zlj9sjc43zhbiwyn-rust-default-1.96.0-nightly-2026-03-24"
             }
+          },
+          "lre-rs-zlib-aarch64-linux": {
+            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:local.bzl%new_local_repository",
+            "attributes": {
+              "build_file": "@@local-remote-execution+//rust:zlib.BUILD.bazel",
+              "path": "/nix/store/dxiaz7djzlgkqi9bzd95x25lhvixvdph-zlib-1.3.2"
+            }
+          },
+          "lre-rs-zlib-x86_64-linux": {
+            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:local.bzl%new_local_repository",
+            "attributes": {
+              "build_file": "@@local-remote-execution+//rust:zlib.BUILD.bazel",
+              "path": "/nix/store/dbz6pb9g67kpgpl95k8d85kzpxm1c32p-zlib-1.3.2"
+            }
           }
         }
       }
diff --git a/deployment-examples/docker-compose/Dockerfile b/deployment-examples/docker-compose/Dockerfile
index 41b9015b2..14db86d32 100644
--- a/deployment-examples/docker-compose/Dockerfile
+++ b/deployment-examples/docker-compose/Dockerfile
@@ -66,4 +66,4 @@ RUN apt-get update \
     && mkdir -p /root/.cache/nativelink
 
 EXPOSE 50051/tcp 50052/tcp
-CMD ["nativelink"]
+ENTRYPOINT ["nativelink"]
diff --git a/deployment-examples/docker-compose/docker-compose-lre.yml b/deployment-examples/docker-compose/docker-compose-lre.yml
new file mode 100644
index 000000000..bd6ab838a
--- /dev/null
+++ b/deployment-examples/docker-compose/docker-compose-lre.yml
@@ -0,0 +1,103 @@
+# Copyright 2026 The NativeLink Authors. All rights reserved.
+#
+# Licensed under the Functional Source License, Version 1.1, Apache 2.0 Future License (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    See LICENSE file for details
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+  nativelink_local_cas:
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    volumes:
+      - ${NATIVELINK_DIR:-~/.cache/nativelink}:/root/.cache/nativelink
+      - type: bind
+        source: .
+        target: /root
+    environment:
+      RUST_LOG: ${RUST_LOG:-warn}
+      NL_LOG: json
+    ports: [ "50051:50051/tcp", "127.0.0.1:50061:50061", "50071:50071/tcp", ]
+    command: |
+      /root/local-storage-cas.json5
+
+  nativelink_scheduler:
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    volumes:
+      - type: bind
+        source: .
+        target: /root
+    environment:
+      RUST_LOG: ${RUST_LOG:-warn}
+      CAS_ENDPOINT: nativelink_local_cas
+      NL_LOG: json
+    ports: [ "50052:50052/tcp" ]
+    command: |
+      /root/scheduler.json5
+    depends_on:
+      - nativelink_local_cas
+
+  executor-init:
+    image: ${NATIVELINK_WORKER_INIT_IMAGE:-trace_machina/nativelink:latest}
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    command: /shared
+    volumes:
+      - exec-shared:/shared
+
+  nativelink_executor:
+    image: ${NATIVELINK_LRE_IMAGE:-trace_machina/nativelink:latest}
+    privileged: true # So we can do use_namespaces
+    build:
+      context: ../..
+      dockerfile: ./deployment-examples/docker-compose/Dockerfile
+      network: host
+      args:
+        - ADDITIONAL_SETUP_WORKER_CMD=${ADDITIONAL_SETUP_WORKER_CMD:-}
+    volumes:
+      - ${NATIVELINK_DIR:-~/.cache/nativelink}:/root/.cache/nativelink
+      - type: bind
+        source: .
+        target: /root
+      - exec-shared:/shared
+    environment:
+      RUST_LOG: ${RUST_LOG:-warn}
+      NL_LOG: json
+      CAS_ENDPOINT: nativelink_local_cas
+      SCHEDULER_ENDPOINT: nativelink_scheduler
+      NATIVELINK_DONT_CLEANUP: 1 # so we have have worker data left over to debug
+    entrypoint: /shared/nativelink
+    command: |
+       /root/worker.json5
+    depends_on:
+      nativelink_local_cas:
+        condition: service_started
+      nativelink_scheduler:
+        condition: service_started
+      executor-init:
+        condition: service_completed_successfully
+
+volumes:
+  exec-shared:
diff --git a/deployment-examples/docker-compose/docker-compose.yml b/deployment-examples/docker-compose/docker-compose.yml
index 3eb071aa1..bb9cdece6 100644
--- a/deployment-examples/docker-compose/docker-compose.yml
+++ b/deployment-examples/docker-compose/docker-compose.yml
@@ -14,7 +14,7 @@
 
 services:
   nativelink_local_cas:
-    image: trace_machina/nativelink:latest
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
     build:
       context: ../..
       dockerfile: ./deployment-examples/docker-compose/Dockerfile
@@ -30,10 +30,10 @@ services:
       RUST_LOG: ${RUST_LOG:-warn}
     ports: [ "50051:50051/tcp", "127.0.0.1:50061:50061", "50071:50071/tcp", ]
     command: |
-      nativelink /root/local-storage-cas.json5
+      /root/local-storage-cas.json5
 
   nativelink_scheduler:
-    image: trace_machina/nativelink:latest
+    image: ${NATIVELINK_IMAGE:-trace_machina/nativelink:latest}
     build:
       context: ../..
       dockerfile: ./deployment-examples/docker-compose/Dockerfile
@@ -49,12 +49,12 @@ services:
       CAS_ENDPOINT: nativelink_local_cas
     ports: [ "50052:50052/tcp" ]
     command: |
-      nativelink /root/scheduler.json5
+      /root/scheduler.json5
     depends_on:
       - nativelink_local_cas
 
   nativelink_executor:
-    image: trace_machina/nativelink:latest
+    image: ${NATIVELINK_LRE_IMAGE:-trace_machina/nativelink:latest}
     privileged: true # So we can do use_namespaces
     build:
       context: ../..
@@ -72,7 +72,9 @@ services:
       CAS_ENDPOINT: nativelink_local_cas
       SCHEDULER_ENDPOINT: nativelink_scheduler
     command: |
-      nativelink /root/worker.json5
+      /root/worker.json5
     depends_on:
-      - nativelink_local_cas
-      - nativelink_scheduler
+      nativelink_local_cas:
+        condition: service_started
+      nativelink_scheduler:
+        condition: service_started
diff --git a/deployment-examples/docker-compose/local-storage-cas.json5 b/deployment-examples/docker-compose/local-storage-cas.json5
index 64e1c8d40..367c1ecb1 100644
--- a/deployment-examples/docker-compose/local-storage-cas.json5
+++ b/deployment-examples/docker-compose/local-storage-cas.json5
@@ -85,13 +85,13 @@
           },
         ],
         capabilities: [],
-        bytestream: {
-          cas_stores: {
-            "": "CAS_MAIN_STORE",
+        bytestream: [
+          {
+            cas_store: "CAS_MAIN_STORE",
           },
-        },
-        fetch: {},
-        push: {},
+        ],
+        fetch: [],
+        push: [],
       },
     },
     {
@@ -122,12 +122,12 @@
           },
         ],
         capabilities: [],
-        bytestream: {
-          cas_stores: {
-            "": "CAS_MAIN_STORE",
+        bytestream: [
+          {
+            cas_store: "CAS_MAIN_STORE",
           },
-        },
-        health: {},
+        ],
+        health: [],
       },
     },
   ],
diff --git a/deployment-examples/docker-compose/worker.json5 b/deployment-examples/docker-compose/worker.json5
index ae2afb881..0a52884a6 100644
--- a/deployment-examples/docker-compose/worker.json5
+++ b/deployment-examples/docker-compose/worker.json5
@@ -63,7 +63,7 @@
         work_directory: "/root/.cache/nativelink/work",
         platform_properties: {
           cpu_count: {
-            query_cmd: "nproc",
+            values: [],
           },
           OSFamily: {
             values: [
diff --git a/flake.nix b/flake.nix
index dee3e0b77..aa8d70466 100644
--- a/flake.nix
+++ b/flake.nix
@@ -418,11 +418,10 @@
 
             default = nativelink;
 
-            nativelink-worker-lre-cc = createWorker pkgs.lre.lre-cc.image;
             lre-java = pkgs.callPackage ./local-remote-execution/lre-java.nix {inherit buildImage;};
             rbe-autogen-lre-java = pkgs.rbe-autogen lre-java;
             nativelink-worker-lre-java = createWorker lre-java;
-            nativelink-worker-lre-rs = createWorker pkgs.lre.lre-rs.image;
+            nativelink-worker-lre-cc = createWorker pkgs.lre.lre-cc.image;
             nativelink-worker-siso-chromium = createWorker siso-chromium;
             nativelink-worker-toolchain-drake = createWorker toolchain-drake;
             nativelink-worker-toolchain-buck2 = createWorker toolchain-buck2;
@@ -475,8 +474,8 @@
         lre = {
           Env = with pkgs.lre;
             if pkgs.stdenv.isDarwin
-            then lre-rs.meta.Env # C++ doesn't support Darwin yet.
-            else (lre-cc.meta.Env ++ lre-rs.meta.Env);
+            then {} # C++ doesn't support Darwin yet.
+            else lre-cc.meta.Env;
           prefix =
             if pkgs.stdenv.isDarwin
             then "macos"
@@ -528,7 +527,6 @@
               # Rust
               bazel
               pkgs.lre.stable-rust
-              pkgs.lre.lre-rs.lre-rs-configs-gen
               pkgs.rust-analyzer
 
               ## Infrastructure
diff --git a/local-remote-execution/MODULE.bazel b/local-remote-execution/MODULE.bazel
index a4ecad5a8..75bd8e674 100644
--- a/local-remote-execution/MODULE.bazel
+++ b/local-remote-execution/MODULE.bazel
@@ -15,7 +15,7 @@ bazel_dep(name = "rules_cc", version = "0.2.19")
 # Use the starlark implementation of Java rules instead of the builtin ones.
 bazel_dep(name = "rules_java", version = "8.11.0")
 bazel_dep(name = "rules_rs", version = "0.0.96")
-bazel_dep(name = "rules_rust", version = "0.68.1")
+bazel_dep(name = "rules_rust", version = "0.71.3")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 # rules_rust is pinned to the hermeticbuild fork in the parent MODULE.bazel via
 # archive_override; this submodule resolves to the same archive automatically.
@@ -37,9 +37,9 @@ use_repo(
 # via lre.bazelrc (`--extra_toolchains`) on the host side; the bootstrap pair
 # only matches when @rules_rust//rust/private:bootstrap_setting is flipped on,
 # which happens transitively when building the rust-built process_wrapper.
-register_toolchains(
-    "//rust:rust-x86_64-linux-bootstrap",
-    "//rust:rust-aarch64-linux-bootstrap",
-    "//rust:rust-x86_64-darwin-bootstrap",
-    "//rust:rust-aarch64-darwin-bootstrap",
-)
+# register_toolchains(
+#     "//rust:rust-x86_64-linux-bootstrap",
+#     "//rust:rust-aarch64-linux-bootstrap",
+#     "//rust:rust-x86_64-darwin-bootstrap",
+#     "//rust:rust-aarch64-darwin-bootstrap",
+# )
diff --git a/local-remote-execution/MODULE.bazel.lock b/local-remote-execution/MODULE.bazel.lock
index a20eb23b9..2244c9a1a 100644
--- a/local-remote-execution/MODULE.bazel.lock
+++ b/local-remote-execution/MODULE.bazel.lock
@@ -82,8 +82,8 @@
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/MODULE.bazel": "2f8d20d3b7d54143213c4dfc3d98225c42de7d666011528dc8fe91591e2e17b0",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.6/source.json": "a04756d367a2126c3541682864ecec52f92cdee80a35735a3cb249ce015ca000",
     "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
-    "https://bcr.bazel.build/modules/llvm/0.7.7/MODULE.bazel": "0eeaf1814feca77abc7af3523e2b9d3735f92e2583043f8d6a2cc0fb5f479a28",
-    "https://bcr.bazel.build/modules/llvm/0.7.7/source.json": "7c8910307329462a21b7bdcc52710360da3de8284738dca52241bb15302a00dc",
+    "https://bcr.bazel.build/modules/llvm/0.8.0/MODULE.bazel": "72e043f9ad3cdd721659c74010fff87a4ce970abf8d47c04f48a0371234191e3",
+    "https://bcr.bazel.build/modules/llvm/0.8.0/source.json": "bbe84a7c74b4bbb964a5dad5071c80e4ea36da42f798f70844658b8fd3b236af",
     "https://bcr.bazel.build/modules/nlohmann_json/3.6.1/MODULE.bazel": "6f7b417dcc794d9add9e556673ad25cb3ba835224290f4f848f8e2db1e1fca74",
     "https://bcr.bazel.build/modules/package_metadata/0.0.3/MODULE.bazel": "77890552ecea9e284b5424c9de827a58099348763a4359e975c359a83d4faa83",
     "https://bcr.bazel.build/modules/package_metadata/0.0.7/MODULE.bazel": "7adb03933fc8401f495800cf4eafcff0edc6da0ff55c7db223ef69d19f689486",
@@ -190,10 +190,10 @@
     "https://bcr.bazel.build/modules/rules_python/1.6.3/MODULE.bazel": "a7b80c42cb3de5ee2a5fa1abc119684593704fcd2fec83165ebe615dec76574f",
     "https://bcr.bazel.build/modules/rules_python/1.7.0/MODULE.bazel": "d01f995ecd137abf30238ad9ce97f8fc3ac57289c8b24bd0bf53324d937a14f8",
     "https://bcr.bazel.build/modules/rules_python/1.7.0/source.json": "028a084b65dcf8f4dc4f82f8778dbe65df133f234b316828a82e060d81bdce32",
-    "https://bcr.bazel.build/modules/rules_rs/0.0.76/MODULE.bazel": "461dcf664f368fdc921f67ea20ec1bc78c73f65a0a20b6e2a6d4b1c77fbde8c1",
-    "https://bcr.bazel.build/modules/rules_rs/0.0.76/source.json": "167eb1122e0f74848fc995b581061155dda1dfd600a38c253a85ef46d0523221",
-    "https://bcr.bazel.build/modules/rules_rust/0.68.1/MODULE.bazel": "8d3332ef4079673385eb81f8bd68b012decc04ac00c9d5a01a40eff90301732c",
-    "https://bcr.bazel.build/modules/rules_rust/0.68.1/source.json": "3378e746f81b62457fdfd37391244fa8ff075ba85c05931ee4f3a20ac1efe963",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.77/MODULE.bazel": "709814c4dc438fe77234ffa04a0ffe12e511e7e7d051590a0e8f43db678e712d",
+    "https://bcr.bazel.build/modules/rules_rs/0.0.77/source.json": "6af335041ccb8a949dad0cf55e4785a68c622012646b820f87a9c40038bf1936",
+    "https://bcr.bazel.build/modules/rules_rust/0.70.0/MODULE.bazel": "5b1407b11c305bc2522e204e7f170faf8399e836e49b6afef9074dfe532e6c3f",
+    "https://bcr.bazel.build/modules/rules_rust/0.70.0/source.json": "24ae6d23425359db1c3148aa22c389970fce9a06102b2b3a329a2800f9569de2",
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
     "https://bcr.bazel.build/modules/rules_shell/0.4.1/MODULE.bazel": "00e501db01bbf4e3e1dd1595959092c2fadf2087b2852d3f553b5370f5633592",
@@ -210,8 +210,8 @@
     "https://bcr.bazel.build/modules/stardoc/0.7.2/source.json": "58b029e5e901d6802967754adf0a9056747e8176f017cfe3607c0851f4d42216",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.2/MODULE.bazel": "75aab2373a4bbe2a1260b9bf2a1ebbdbf872d3bd36f80bff058dccd82e89422f",
-    "https://bcr.bazel.build/modules/tar.bzl/0.9.0/MODULE.bazel": "452a22d7f02b1c9d7a22ab25edf20f46f3e1101f0f67dc4bfbf9a474ddf02445",
-    "https://bcr.bazel.build/modules/tar.bzl/0.9.0/source.json": "c732760a374831a2cf5b08839e4be75017196b4d796a5aa55235272ee17cd839",
+    "https://bcr.bazel.build/modules/tar.bzl/0.10.4/MODULE.bazel": "e8f9ff79199e8d9eaad7f1b0a77ad74b30bb82d794b87d8ca942bead5de83ae9",
+    "https://bcr.bazel.build/modules/tar.bzl/0.10.4/source.json": "20143442376c03426f6135292ba02d825cb75308aa47e6bf42dd4cc5a435c2ff",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/MODULE.bazel": "b573395fe63aef4299ba095173e2f62ccfee5ad9bbf7acaa95dba73af9fc2b38",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/source.json": "3f3fbaeafecaf629877ad152a2c9def21f8d330d91aa94c5dc75bbb98c10b8b8",
diff --git a/local-remote-execution/cpp_env.json b/local-remote-execution/cpp_env.json
index 965bdcfad..c89c697c0 100644
--- a/local-remote-execution/cpp_env.json
+++ b/local-remote-execution/cpp_env.json
@@ -1,5 +1,5 @@
 {
   "ABI_LIBC_VERSION": "glibc_2.38",
-  "BAZEL_HOST_SYSTEM": "x86_64-unknown-linux-gnu",
+  "BAZEL_HOST_SYSTEM": "x86_64-unknown-linux-musl",
   "BAZEL_TARGET_LIBC": "glibc_2.38"
 }
diff --git a/local-remote-execution/flake-module.nix b/local-remote-execution/flake-module.nix
index 5c3f3005b..325880d19 100644
--- a/local-remote-execution/flake-module.nix
+++ b/local-remote-execution/flake-module.nix
@@ -95,30 +95,6 @@
             ${lib.concatLines maybePrefixedConfig}
           '';
 
-          nixExecToRustExec = p: let
-            inherit (p.stdenv.buildPlatform) system;
-          in
-            {
-              "aarch64-darwin" = "aarch64-apple-darwin";
-              "aarch64-linux" = "aarch64-unknown-linux-gnu";
-              "x86_64-darwin" = "x86_64-apple-darwin";
-              "x86_64-linux" = "x86_64-unknown-linux-gnu";
-            }.${
-              system
-            } or (throw "Unsupported Nix exec platform: ${system}");
-
-          nixExecToDefaultRustTarget = p: let
-            inherit (p.stdenv.targetPlatform) system;
-          in
-            {
-              "aarch64-darwin" = "aarch64-apple-darwin";
-              "aarch64-linux" = "aarch64-unknown-linux-musl";
-              "x86_64-darwin" = "x86_64-apple-darwin";
-              "x86_64-linux" = "x86_64-unknown-linux-musl";
-            }.${
-              system
-            } or (throw "Unsupported Nix target platform: ${system}");
-
           # These flags cause a Bazel build to use LRE toolchains regardless of whether
           # the build is running in local or remote configuration.
           #
@@ -147,17 +123,11 @@
               # When using remote executors that differ from the host this needs to
               # be manually extended via the `--extra_execution_platforms` flag.
               "--extra_execution_platforms=${
-                lib.concatStringsSep "," ([
-                    # Explicitly duplicate the host as an execution platform. This way
-                    # local execution is treated the same as remote execution.
-                    "@local-remote-execution//rust/platforms:${nixExecToRustExec pkgs}"
-                    "@local-remote-execution//rust/platforms:${nixExecToDefaultRustTarget pkgs}"
-                  ]
-                  ++ lib.optionals pkgs.stdenv.isLinux [
-                    # TODO(palfrey): Reimplement rbe-configs-gen for C++ so that we
-                    #                    can support more execution and target platforms.
-                    "@local-remote-execution//generated-cc/config:platform"
-                  ])
+                lib.concatStringsSep "," (lib.optionals pkgs.stdenv.isLinux [
+                  # TODO(palfrey): Reimplement rbe-configs-gen for C++ so that we
+                  #                    can support more execution and target platforms.
+                  "@local-remote-execution//generated-cc/config:platform"
+                ])
               }"
             ]
             # C++.
@@ -172,22 +142,6 @@
 
               # TODO(palfrey): Support different target platforms in lre-cc and add
               #                    `--platforms` settings here.
-            ]
-            # Rust.
-            ++ [
-              # The rust toolchains executing on the execution platform. We default to the
-              # platforms corresponding to the host. When using remote executors that
-              # differ from the platform corresponding to the host this should be extended
-              # via manual `--extra_toolchains` arguments.
-              "--extra_toolchains=@local-remote-execution//rust:rust-${pkgs.stdenv.hostPlatform.system}"
-              "--extra_toolchains=@local-remote-execution//rust:rustfmt-${pkgs.stdenv.hostPlatform.system}"
-
-              # Defaults for rust target platforms. This is a convenience setting that
-              # may be overridden by manual `--platforms` arguments.
-              #
-              # TODO(palfrey): At the moment these platforms are "rust-specific".
-              #                    Generalize this to all languages.
-              "--platforms=@local-remote-execution//rust/platforms:${nixExecToDefaultRustTarget pkgs}"
             ];
 
           maybeEnv =
diff --git a/local-remote-execution/generated-cc/cc/BUILD b/local-remote-execution/generated-cc/cc/BUILD
index 705f4607e..d790de2ca 100644
--- a/local-remote-execution/generated-cc/cc/BUILD
+++ b/local-remote-execution/generated-cc/cc/BUILD
@@ -134,7 +134,7 @@ cc_toolchain_config(
         "-Xclang",
         "-fno-cxx-modules",
     ]},
-    host_system_name = "x86_64-unknown-linux-gnu",
+    host_system_name = "x86_64-unknown-linux-musl",
     link_flags = [
         "-fuse-ld=/nix/store/c5z0kxmshkd2j8bflq22ya45f7fssn0l-llvm-binutils-wrapper-22.1.8/bin/ld.mold",
         "-B/nix/store/n4rzbc1y6z5dj0wr884rmn85lz0dfi1l-customClang/bin",
diff --git a/local-remote-execution/generated-cc/config/BUILD b/local-remote-execution/generated-cc/config/BUILD
index 177218c70..b10b8f8ae 100644
--- a/local-remote-execution/generated-cc/config/BUILD
+++ b/local-remote-execution/generated-cc/config/BUILD
@@ -43,5 +43,5 @@ platform(
         "container-image": "docker://lre-cc:nz62ssm01zq2sq4768h58lnfalmpr7bz",
         "OSFamily": "Linux",
     },
-    parents = ["@platforms//host"],
+    # parents = ["@platforms//host"],
 )
diff --git a/local-remote-execution/generated-java/config/BUILD b/local-remote-execution/generated-java/config/BUILD
index 7e454e001..027fe808f 100644
--- a/local-remote-execution/generated-java/config/BUILD
+++ b/local-remote-execution/generated-java/config/BUILD
@@ -28,5 +28,5 @@ platform(
         "container-image": "docker://lre-java:ym272rns245alxpq07dwc65jvh0mpy74",
         "OSFamily": "Linux",
     },
-    parents = ["@platforms//host"],
+    # parents = ["@platforms//host"],
 )
diff --git a/local-remote-execution/overlays/default.nix b/local-remote-execution/overlays/default.nix
index e7c34936c..65d6c861a 100644
--- a/local-remote-execution/overlays/default.nix
+++ b/local-remote-execution/overlays/default.nix
@@ -38,9 +38,5 @@
       nightly-rust = nightlyRustFor final;
     in {
       inherit stable-rust nightly-rust stableRustFor nightlyRustFor;
-
-      lre-rs = final.callPackage ./lre-rs.nix {
-        inherit (rustConfig) nixSystemToRustTargets;
-      };
     });
 }
diff --git a/local-remote-execution/overlays/lre-rs.nix b/local-remote-execution/overlays/lre-rs.nix
deleted file mode 100644
index 61af70e6a..000000000
--- a/local-remote-execution/overlays/lre-rs.nix
+++ /dev/null
@@ -1,249 +0,0 @@
-{
-  lib,
-  nixSystemToRustTargets,
-  writeShellScriptBin,
-  nix2container,
-  lre,
-  rust-toolchains ? [lre.stable-rust lre.nightly-rust],
-}: let
-  copyright = ''
-    # Copyright 2024 The NativeLink Authors. All rights reserved.
-    #
-    # Licensed under the Apache License, Version 2.0 (the "License");
-    # you may not use this file except in compliance with the License.
-    # You may obtain a copy of the License at
-    #
-    #    http://www.apache.org/licenses/LICENSE-2.0
-    #
-    # Unless required by applicable law or agreed to in writing, software
-    # distributed under the License is distributed on an "AS IS" BASIS,
-    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    # See the License for the specific language governing permissions and
-    # limitations under the License.
-
-    # This file is @generated by lre-rs.
-  '';
-
-  systems = [
-    "aarch64-darwin"
-    "aarch64-linux"
-    "x86_64-darwin"
-    "x86_64-linux"
-  ];
-  channels = [
-    "stable"
-    "nightly"
-  ];
-
-  makeRepoDefinition = system: channel: ''
-    ${" "}   new_local_repository(
-    ${" "}       name = "lre-rs-${channel}-${system}",
-    ${" "}       build_file = "@local-remote-execution//rust:${system}.BUILD.bazel",
-    ${" "}       path = "$(nix eval .#packages.${system}.${channel}-rust.outPath --raw)",
-    ${" "}   )
-  '';
-
-  allRepoDefinitions = lib.concatStrings (lib.flatten (
-    map (system: map (channel: makeRepoDefinition system channel) channels) systems
-  ));
-
-  buildFile = system: let
-    rustTargets = nixSystemToRustTargets.${system};
-
-    # Generate select entry for a target
-    mkSelectEntry = target: ''
-      ${" "}       "@local-remote-execution//rust/triple:${target}": glob([
-      ${" "}           "bin/*.so",
-      ${" "}           "lib/*.so",
-      ${" "}           "lib/rustlib/${target}/codegen-backends/*.so",
-      ${" "}           "lib/rustlib/${target}/lib/*.so",
-      ${" "}       ] + ["lib/rustlib/${target}/bin/rust-lld"],
-      ${" "}       allow_empty = True),'';
-
-    # Generate stdlib select entry for a target
-    mkStdlibSelectEntry = target:
-      ''
-        ${" "}       "@local-remote-execution//rust/triple:${target}": glob([
-        ${" "}           "lib/rustlib/${target}/lib/*.rlib",
-        ${" "}           "lib/rustlib/${target}/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-        ${" "}           "lib/rustlib/${target}/lib/*.so",
-        ${" "}           "lib/rustlib/${target}/lib/*.a",''
-      + (lib.optionalString (builtins.match ".*-musl" target != null)
-        ''${"\n "}           "lib/rustlib/${target}/lib/self-contained/**",'')
-      + ''${"\n "}       ], allow_empty = True),'';
-
-    selectEntries = builtins.concatStringsSep "\n" (map mkSelectEntry rustTargets);
-    stdlibSelectEntries = builtins.concatStringsSep "\n" (map mkStdlibSelectEntry rustTargets);
-  in ''
-    ${copyright}
-    """Tool repository for lre-rs executing on ${system}."""
-
-    load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
-
-    [
-        filegroup(
-            name = tool,
-            srcs = [
-                "bin/{}".format(tool),
-            ],
-            visibility = ["//visibility:public"],
-        )
-        for tool in [
-            "rustc",
-            "rustfmt",
-            "cargo",
-            "cargo-clippy",
-            "clippy-driver",
-            "rustdoc",
-        ]
-    ]
-
-    filegroup(
-        name = "rustc_lib",
-        srcs = select({
-    ${selectEntries}
-        }),
-        visibility = ["//visibility:public"],
-    )
-
-    rust_stdlib_filegroup(
-        name = "rust_std",
-        srcs = select({
-    ${stdlibSelectEntries}
-        }),
-        visibility = ["//visibility:public"],
-    )'';
-
-  lre-rs-configs-gen = writeShellScriptBin "lre-rs" ''
-    set -euo pipefail
-
-    SRC_ROOT=$(git rev-parse --show-toplevel)/local-remote-execution
-
-    cd "''${SRC_ROOT}"
-
-    cat > ''${SRC_ROOT}/rust/extension.bzl << EOF
-    ${copyright}
-    """Module extension to register different lre-rs tool repositories."""
-
-    load("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")
-
-    # TODO(palfrey): Using module extensions here isn't optimal as it doesn't
-    #                    allow overriding tools via environment variables.
-    #                    Unfortunately rules_rust's rust_toolchain currently
-    #                    requires tools to be declared via labels to filegroups,
-    #                    so we need the new_local_repository approach here.
-    #                    Add support for raw strings to rules_rust upstream so
-    #                    that we can remove this module extension entirely.
-
-    def _lre_rs_impl(_mctx):
-    ${allRepoDefinitions}
-    lre_rs = module_extension(implementation = _lre_rs_impl)
-    EOF
-
-    cat > ''${SRC_ROOT}/rust/platforms/BUILD.bazel << EOF
-    ${copyright}
-    # Some toolchains, like the darwin ones, don't have an actual container image.
-    # We still map them to the output of the tag of the corresponding theoretical
-    # worker image so that bare metal workers can advertise exact
-    # exec_properties to schedulers.
-
-    platform(
-        name = "aarch64-apple-darwin",
-        exec_properties = {
-            # tag is from nix eval .#packages.aarch64-darwin.nativelink-worker-lre-rs.imageTag
-            "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:$(nix eval --raw .#packages.aarch64-darwin.nativelink-worker-lre-rs.imageTag)",
-        },
-        parents = ["@local-remote-execution//platforms:aarch64-darwin"],
-    )
-
-    platform(
-        name = "aarch64-unknown-linux-gnu",
-        constraint_values = ["@local-remote-execution//libc:glibc"],
-        exec_properties = {
-            # tag is from nix eval .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag
-            "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:$(nix eval --raw .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag)",
-        },
-        parents = ["@local-remote-execution//platforms:aarch64-linux"],
-    )
-
-    platform(
-        name = "aarch64-unknown-linux-musl",
-        constraint_values = ["@local-remote-execution//libc:musl"],
-        exec_properties = {
-            # tag is from nix eval .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag
-            "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:$(nix eval --raw .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag)",
-        },
-        parents = ["@local-remote-execution//platforms:aarch64-linux"],
-    )
-
-    platform(
-        name = "x86_64-apple-darwin",
-        exec_properties = {
-            # tag is from nix eval .#packages.x86_64-darwin.nativelink-worker-lre-rs.imageTag
-            "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:$(nix eval --raw .#packages.x86_64-darwin.nativelink-worker-lre-rs.imageTag)",
-        },
-        parents = ["@local-remote-execution//platforms:x86_64-darwin"],
-    )
-
-    platform(
-        name = "x86_64-unknown-linux-gnu",
-        constraint_values = ["@local-remote-execution//libc:glibc"],
-        exec_properties = {
-            # tag is from nix eval .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag
-            "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:$(nix eval --raw .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag)",
-        },
-        parents = ["@local-remote-execution//platforms:x86_64-linux"],
-    )
-
-    platform(
-        name = "x86_64-unknown-linux-musl",
-        constraint_values = ["@local-remote-execution//libc:musl"],
-        exec_properties = {
-            # tag is from nix eval .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag
-            "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:$(nix eval --raw .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag)",
-        },
-        parents = ["@local-remote-execution//platforms:x86_64-linux"],
-    )
-    EOF
-
-    cat > ''${SRC_ROOT}/rust/aarch64-darwin.BUILD.bazel << EOF
-    ${buildFile "aarch64-darwin"}
-    EOF
-
-    cat > ''${SRC_ROOT}/rust/aarch64-linux.BUILD.bazel << EOF
-    ${buildFile "aarch64-linux"}
-    EOF
-
-    cat > ''${SRC_ROOT}/rust/x86_64-darwin.BUILD.bazel << EOF
-    ${buildFile "x86_64-darwin"}
-    EOF
-
-    cat > ''${SRC_ROOT}/rust/x86_64-linux.BUILD.bazel << EOF
-    ${buildFile "x86_64-linux"}
-    EOF'';
-
-  Env =
-    # Rust requires a functional C++ toolchain.
-    lre.lre-cc.image.meta.Env
-    ++ [
-      # This causes the rust toolchains to be available under `/nix/store/*`
-      # paths but not under "generic" paths like `/bin` or `/usr/bin`.
-      # This way we're guaranteed to use binary identical toolchains during
-      # local and remote execution.
-      "RUST=${lib.concatStringsSep ":" rust-toolchains}"
-    ];
-
-  image = nix2container.buildImage {
-    name = "lre-rs";
-    maxLayers = 100;
-    config = {inherit Env;};
-    # Passthrough so that other images can reuse the environment.
-    meta = {inherit Env;};
-
-    # Don't set a tag here so that the image is tagged by its derivation hash.
-    # tag = null;
-  };
-in {
-  inherit lre-rs-configs-gen image;
-  meta = {inherit Env;};
-}
diff --git a/local-remote-execution/rust/BUILD.bazel b/local-remote-execution/rust/BUILD.bazel
deleted file mode 100644
index be3a63088..000000000
--- a/local-remote-execution/rust/BUILD.bazel
+++ /dev/null
@@ -1,302 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
-load(
-    "@rules_rust//rust:toolchain.bzl",
-    "rust_toolchain",
-    "rustfmt_toolchain",
-)
-
-string_flag(
-    name = "channel",
-    build_setting_default = "stable",
-    values = [
-        "stable",
-        "nightly",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-config_setting(
-    name = "stable",
-    flag_values = {":channel": "stable"},
-)
-
-config_setting(
-    name = "nightly",
-    flag_values = {":channel": "nightly"},
-)
-
-string_flag(
-    name = "rustfmt-channel",
-    # It's a common use case (and matching with rules_rust's default behavior)
-    # to use nightly rustfmt with a stable rust toolchain, so we default to
-    # nightly here.
-    build_setting_default = "nightly",
-    values = [
-        "stable",
-        "nightly",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-config_setting(
-    name = "rustfmt-stable",
-    flag_values = {":rustfmt-channel": "stable"},
-)
-
-config_setting(
-    name = "rustfmt-nightly",
-    flag_values = {":rustfmt-channel": "nightly"},
-)
-
-[
-    rust_toolchain(
-        name = "rust-{}-{}{}_impl".format(channel, nix_system, suffix),
-        allocator_library = select({
-            "@local-remote-execution//libc:musl": None,
-            "//conditions:default": "@rules_rust//ffi/cc/allocator_library",
-        }),
-        binary_ext = "",
-        # The hermeticbuild fork of rules_rust requires process_wrapper to be
-        # set explicitly on every toolchain. We register two flavors:
-        #   * the regular toolchain uses the rust-built process_wrapper for
-        #     full functionality (env files, stamping, etc.);
-        #   * the bootstrap toolchain (suffix "_bootstrap", bootstrapping = True)
-        #     uses the C++ bootstrap_process_wrapper so it can build the rust
-        #     process_wrapper itself without creating a dependency cycle.
-        bootstrapping = bootstrapping,
-        cargo = "@lre-rs-{}-{}//:cargo".format(channel, nix_system),
-        cargo_clippy = "@lre-rs-{}-{}//:cargo-clippy".format(channel, nix_system),
-        clippy_driver = "@lre-rs-{}-{}//:clippy-driver".format(channel, nix_system),
-
-        # Currently the same as rules_rust's default:
-        # https://bazelbuild.github.io/rules_rust/flatten.html#rust_toolchain-debug_info
-        # This may change at any time.
-        debug_info = {
-            "dbg": "2",
-            "fastbuild": "0",
-            "opt": "0",
-        },
-        default_edition = "2024",
-        dylib_ext = select({
-            "@platforms//os:linux": ".so",
-            "@platforms//os:macos": ".dylib",
-            "//conditions:default": "@platforms//:incompatible",
-        }),
-        env = {},
-        exec_triple = {
-            "x86_64-linux": "x86_64-unknown-linux-gnu",
-            "aarch64-linux": "aarch64-unknown-linux-gnu",
-            "x86_64-darwin": "x86_64-apple-darwin",
-            "aarch64-darwin": "aarch64-apple-darwin",
-        }[nix_system],
-
-        # TODO(palfrey): Make these easily configurable.
-        extra_exec_rustc_flags = [],
-        extra_rustc_flags = [],
-        extra_rustc_flags_for_crate_types = {},
-        global_allocator_library = select({
-            "@local-remote-execution//libc:musl": None,
-            "//conditions:default": "@rules_rust//ffi/cc/global_allocator_library",
-        }),
-
-        # TODO(palfrey): Implement these.
-        # llvm_cov,
-        # llvm_profdata,
-        # llvm_tools,
-
-        # Currently the same as rules_rust's default:
-        # https://bazelbuild.github.io/rules_rust/flatten.html#rust_toolchain-opt_level
-        # This may change at any time.
-        opt_level = {
-            "dbg": "0",
-            "fastbuild": "0",
-            "opt": "3",
-        },
-        per_crate_rustc_flags = [],
-        process_wrapper =
-            "@rules_rust//util/process_wrapper:bootstrap_process_wrapper" if bootstrapping else "@rules_rust//util/process_wrapper",
-        rust_doc = "@lre-rs-{}-{}//:rustdoc".format(channel, nix_system),
-        rust_std = "@lre-rs-{}-{}//:rust_std".format(channel, nix_system),
-        rustc = "@lre-rs-{}-{}//:rustc".format(channel, nix_system),
-        rustc_lib = "@lre-rs-{}-{}//:rustc_lib".format(channel, nix_system),
-        rustfmt = None,  # Rustfmt actions use the rustfmt-toolchain.
-        staticlib_ext = ".a",
-        stdlib_linkflags = select(
-            {
-                "@local-remote-execution//libc:glibc": [
-                    "-fuse-ld=mold",
-                    "-lpthread",
-                    "-ldl",
-                ],
-                "@local-remote-execution//libc:musl": [
-                    "-fuse-ld=mold",
-                ],
-                "@platforms//os:macos": [],
-            },
-            no_match_error = "Linking for unset libc on linux isn't implemented yet.",
-        ),
-
-        # Currently the same as rules_rust's default:
-        # https://bazelbuild.github.io/rules_rust/flatten.html#rust_toolchain-strip_level
-        # This may change at any time.
-        strip_level = {
-            "dbg": "none",
-            "fastbuild": "none",
-            "opt": "debuginfo",
-        },
-        target_json = "",
-        target_triple = select(
-            {
-                "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": "aarch64-unknown-linux-gnu",
-                "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": "aarch64-unknown-linux-musl",
-                "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": "x86_64-unknown-linux-gnu",
-                "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": "x86_64-unknown-linux-musl",
-            } | ({
-                "@local-remote-execution//rust/triple:x86_64-apple-darwin": "x86_64-apple-darwin",
-                "@local-remote-execution//rust/triple:aarch64-apple-darwin": "aarch64-apple-darwin",
-            } if nix_system in [
-                "aarch64-darwin",
-                "x86_64-darwin",
-            ] else {}),
-            no_match_error = "Incompatible target triple supplied to lre-rs-toolchain running on {}.".format(nix_system),
-        ),
-    )
-    for channel in [
-        "stable",
-        "nightly",
-    ]
-    for nix_system in [
-        "x86_64-linux",
-        "aarch64-linux",
-        "x86_64-darwin",
-        "aarch64-darwin",
-    ]
-    for (suffix, bootstrapping) in [
-        ("", False),
-        ("_bootstrap", True),
-    ]
-]
-
-[
-    toolchain(
-        name = "rust-{}-{}".format(arch, os),
-        exec_compatible_with = [
-            "@platforms//os:{}".format(os if os == "linux" else "macos"),
-            "@platforms//cpu:{}".format(arch),
-            "@bazel_tools//tools/cpp:clang",
-        ],
-        target_compatible_with =
-            # Linux toolchains can only target other linux systems.
-            # Darwin toolchains can target everything.
-            ["@platforms//os:linux"] if os == "linux" else [],
-        # Only matched when not bootstrapping process_wrapper. The bootstrap
-        # toolchain below sits behind ":bootstrapping" instead.
-        target_settings = ["@rules_rust//rust/private:bootstrapped"],
-        toolchain = select({
-            ":stable": ":rust-stable-{}-{}_impl".format(arch, os),
-            ":nightly": ":rust-nightly-{}-{}_impl".format(arch, os),
-        }),
-        toolchain_type = "@rules_rust//rust:toolchain_type",
-    )
-    for arch in [
-        "aarch64",
-        "x86_64",
-    ]
-    for os in [
-        "linux",
-        "darwin",
-    ]
-]
-
-# Bootstrap toolchains: only matched when @rules_rust//rust/private:bootstrap_setting
-# is flipped to True (which happens transitively when the build is producing the
-# rust-built process_wrapper). They use bootstrap_process_wrapper so the rust
-# process_wrapper itself can be built without depending on itself.
-[
-    toolchain(
-        name = "rust-{}-{}-bootstrap".format(arch, os),
-        exec_compatible_with = [
-            "@platforms//os:{}".format(os if os == "linux" else "macos"),
-            "@platforms//cpu:{}".format(arch),
-            "@bazel_tools//tools/cpp:clang",
-        ],
-        target_compatible_with =
-            ["@platforms//os:linux"] if os == "linux" else [],
-        target_settings = ["@rules_rust//rust/private:bootstrapping"],
-        toolchain = select({
-            ":stable": ":rust-stable-{}-{}_bootstrap_impl".format(arch, os),
-            ":nightly": ":rust-nightly-{}-{}_bootstrap_impl".format(arch, os),
-        }),
-        toolchain_type = "@rules_rust//rust:toolchain_type",
-    )
-    for arch in [
-        "aarch64",
-        "x86_64",
-    ]
-    for os in [
-        "linux",
-        "darwin",
-    ]
-]
-
-[
-    rustfmt_toolchain(
-        name = "rustfmt-{}-{}_impl".format(channel, nix_system),
-        rustc = "@lre-rs-{}-{}//:rustc".format(channel, nix_system),
-        rustc_lib = "@lre-rs-{}-{}//:rustc_lib".format(channel, nix_system),
-        rustfmt = "@lre-rs-{}-{}//:rustfmt".format(channel, nix_system),
-    )
-    for nix_system in [
-        "x86_64-linux",
-        "aarch64-linux",
-        "x86_64-darwin",
-        "aarch64-darwin",
-    ]
-    for channel in [
-        "stable",
-        "nightly",
-    ]
-]
-
-# Limit rustfmt to exec == target until we find a good reason to do otherwise.
-[
-    toolchain(
-        name = "rustfmt-{}-{}".format(arch, os),
-        exec_compatible_with = [
-            "@platforms//os:{}".format(os if os == "linux" else "macos"),
-            "@platforms//cpu:{}".format(arch),
-            "@bazel_tools//tools/cpp:clang",
-        ],
-        target_compatible_with = [
-            "@platforms//os:{}".format(os if os == "linux" else "macos"),
-            "@platforms//cpu:{}".format(arch),
-        ],
-        toolchain = select({
-            ":rustfmt-stable": ":rustfmt-stable-{}-{}_impl".format(arch, os),
-            ":rustfmt-nightly": ":rustfmt-nightly-{}-{}_impl".format(arch, os),
-        }),
-        toolchain_type = "@rules_rust//rust/rustfmt:toolchain_type",
-    )
-    for arch in [
-        "aarch64",
-        "x86_64",
-    ]
-    for os in [
-        "darwin",
-        "linux",
-    ]
-]
diff --git a/local-remote-execution/rust/aarch64-darwin.BUILD.bazel b/local-remote-execution/rust/aarch64-darwin.BUILD.bazel
deleted file mode 100644
index d20345787..000000000
--- a/local-remote-execution/rust/aarch64-darwin.BUILD.bazel
+++ /dev/null
@@ -1,161 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file is @generated by lre-rs.
-
-"""Tool repository for lre-rs executing on aarch64-darwin."""
-
-load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
-
-[
-    filegroup(
-        name = tool,
-        srcs = [
-            "bin/{}".format(tool),
-        ],
-        visibility = ["//visibility:public"],
-    )
-    for tool in [
-        "rustc",
-        "rustfmt",
-        "cargo",
-        "cargo-clippy",
-        "clippy-driver",
-        "rustdoc",
-    ]
-]
-
-filegroup(
-    name = "rustc_lib",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-apple-darwin": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-apple-darwin/codegen-backends/*.so",
-                "lib/rustlib/aarch64-apple-darwin/lib/*.so",
-            ] + ["lib/rustlib/aarch64-apple-darwin/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-apple-darwin": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-apple-darwin/codegen-backends/*.so",
-                "lib/rustlib/x86_64-apple-darwin/lib/*.so",
-            ] + ["lib/rustlib/x86_64-apple-darwin/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
-
-rust_stdlib_filegroup(
-    name = "rust_std",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-apple-darwin": glob(
-            [
-                "lib/rustlib/aarch64-apple-darwin/lib/*.rlib",
-                "lib/rustlib/aarch64-apple-darwin/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-apple-darwin/lib/*.so",
-                "lib/rustlib/aarch64-apple-darwin/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-apple-darwin": glob(
-            [
-                "lib/rustlib/x86_64-apple-darwin/lib/*.rlib",
-                "lib/rustlib/x86_64-apple-darwin/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-apple-darwin/lib/*.so",
-                "lib/rustlib/x86_64-apple-darwin/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
diff --git a/local-remote-execution/rust/aarch64-linux.BUILD.bazel b/local-remote-execution/rust/aarch64-linux.BUILD.bazel
deleted file mode 100644
index 8c41080fe..000000000
--- a/local-remote-execution/rust/aarch64-linux.BUILD.bazel
+++ /dev/null
@@ -1,125 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file is @generated by lre-rs.
-
-"""Tool repository for lre-rs executing on aarch64-linux."""
-
-load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
-
-[
-    filegroup(
-        name = tool,
-        srcs = [
-            "bin/{}".format(tool),
-        ],
-        visibility = ["//visibility:public"],
-    )
-    for tool in [
-        "rustc",
-        "rustfmt",
-        "cargo",
-        "cargo-clippy",
-        "clippy-driver",
-        "rustdoc",
-    ]
-]
-
-filegroup(
-    name = "rustc_lib",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
-
-rust_stdlib_filegroup(
-    name = "rust_std",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
diff --git a/local-remote-execution/rust/extension.bzl b/local-remote-execution/rust/extension.bzl
deleted file mode 100644
index b4c66ca03..000000000
--- a/local-remote-execution/rust/extension.bzl
+++ /dev/null
@@ -1,71 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file is @generated by lre-rs.
-
-"""Module extension to register different lre-rs tool repositories."""
-
-load("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")
-
-# TODO(palfrey): Using module extensions here isn't optimal as it doesn't
-#                    allow overriding tools via environment variables.
-#                    Unfortunately rules_rust's rust_toolchain currently
-#                    requires tools to be declared via labels to filegroups,
-#                    so we need the new_local_repository approach here.
-#                    Add support for raw strings to rules_rust upstream so
-#                    that we can remove this module extension entirely.
-
-def _lre_rs_impl(_mctx):
-    new_local_repository(
-        name = "lre-rs-stable-aarch64-darwin",
-        build_file = "@local-remote-execution//rust:aarch64-darwin.BUILD.bazel",
-        path = "/nix/store/2mchcvza9v1j5mx67r4770plmrkm0f68-rust-default-1.93.1",
-    )
-    new_local_repository(
-        name = "lre-rs-nightly-aarch64-darwin",
-        build_file = "@local-remote-execution//rust:aarch64-darwin.BUILD.bazel",
-        path = "/nix/store/1dysg6qbzyb7vanwsc5y756zmb0227z9-rust-default-1.96.0-nightly-2026-03-24",
-    )
-    new_local_repository(
-        name = "lre-rs-stable-aarch64-linux",
-        build_file = "@local-remote-execution//rust:aarch64-linux.BUILD.bazel",
-        path = "/nix/store/vx2ziqrqc0qj0pjng71cpcyainq52xqd-rust-default-1.93.1",
-    )
-    new_local_repository(
-        name = "lre-rs-nightly-aarch64-linux",
-        build_file = "@local-remote-execution//rust:aarch64-linux.BUILD.bazel",
-        path = "/nix/store/zl02i3a6zzw5mxd665y2n7mp97ajdwkx-rust-default-1.96.0-nightly-2026-03-24",
-    )
-    new_local_repository(
-        name = "lre-rs-stable-x86_64-darwin",
-        build_file = "@local-remote-execution//rust:x86_64-darwin.BUILD.bazel",
-        path = "/nix/store/qjpia0l98w7wpf9b3nzfb24y8rxh52cg-rust-default-1.93.1",
-    )
-    new_local_repository(
-        name = "lre-rs-nightly-x86_64-darwin",
-        build_file = "@local-remote-execution//rust:x86_64-darwin.BUILD.bazel",
-        path = "/nix/store/wdyvk55ys5m7shpp6jw9d8116m3dlmjd-rust-default-1.96.0-nightly-2026-03-24",
-    )
-    new_local_repository(
-        name = "lre-rs-stable-x86_64-linux",
-        build_file = "@local-remote-execution//rust:x86_64-linux.BUILD.bazel",
-        path = "/nix/store/cgzz6kbvvhxh4k71rlj9wj14mdbn02n9-rust-default-1.93.1",
-    )
-    new_local_repository(
-        name = "lre-rs-nightly-x86_64-linux",
-        build_file = "@local-remote-execution//rust:x86_64-linux.BUILD.bazel",
-        path = "/nix/store/5pysp36qjzbwdjx9zlj9sjc43zhbiwyn-rust-default-1.96.0-nightly-2026-03-24",
-    )
-
-lre_rs = module_extension(implementation = _lre_rs_impl)
diff --git a/local-remote-execution/rust/platforms/BUILD.bazel b/local-remote-execution/rust/platforms/BUILD.bazel
deleted file mode 100644
index a28acbe2b..000000000
--- a/local-remote-execution/rust/platforms/BUILD.bazel
+++ /dev/null
@@ -1,78 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file is @generated by lre-rs.
-
-# Some toolchains, like the darwin ones, don't have an actual container image.
-# We still map them to the output of the tag of the corresponding theoretical
-# worker image so that bare metal workers can advertise exact
-# exec_properties to schedulers.
-
-platform(
-    name = "aarch64-apple-darwin",
-    exec_properties = {
-        # tag is from nix eval .#packages.aarch64-darwin.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:cqzqrwpx7hfvir24hj06m4y5s5nxym5g",
-    },
-    parents = ["@local-remote-execution//platforms:aarch64-darwin"],
-)
-
-platform(
-    name = "aarch64-unknown-linux-gnu",
-    constraint_values = ["@local-remote-execution//libc:glibc"],
-    exec_properties = {
-        # tag is from nix eval .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:xy9qmvic63aczmix71dgzg5dfrlq1if8",
-    },
-    parents = ["@local-remote-execution//platforms:aarch64-linux"],
-)
-
-platform(
-    name = "aarch64-unknown-linux-musl",
-    constraint_values = ["@local-remote-execution//libc:musl"],
-    exec_properties = {
-        # tag is from nix eval .#packages.aarch64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:xy9qmvic63aczmix71dgzg5dfrlq1if8",
-    },
-    parents = ["@local-remote-execution//platforms:aarch64-linux"],
-)
-
-platform(
-    name = "x86_64-apple-darwin",
-    exec_properties = {
-        # tag is from nix eval .#packages.x86_64-darwin.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:hz9s5p98hy5hgkn6ab0ny13fsi25b491",
-    },
-    parents = ["@local-remote-execution//platforms:x86_64-darwin"],
-)
-
-platform(
-    name = "x86_64-unknown-linux-gnu",
-    constraint_values = ["@local-remote-execution//libc:glibc"],
-    exec_properties = {
-        # tag is from nix eval .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:1hvvyzz0z4rs6d9arlnxc05pxz8qz7zj",
-    },
-    parents = ["@local-remote-execution//platforms:x86_64-linux"],
-)
-
-platform(
-    name = "x86_64-unknown-linux-musl",
-    constraint_values = ["@local-remote-execution//libc:musl"],
-    exec_properties = {
-        # tag is from nix eval .#packages.x86_64-linux.nativelink-worker-lre-rs.imageTag
-        "container-image": "ghcr.io/tracemachina/nativelink-worker-lre-rs:1hvvyzz0z4rs6d9arlnxc05pxz8qz7zj",
-    },
-    parents = ["@local-remote-execution//platforms:x86_64-linux"],
-)
diff --git a/local-remote-execution/rust/triple/BUILD.bazel b/local-remote-execution/rust/triple/BUILD.bazel
deleted file mode 100644
index 3a60ceade..000000000
--- a/local-remote-execution/rust/triple/BUILD.bazel
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# These config settings correspond to rust triples.
-
-load("@bazel_skylib//lib:selects.bzl", "selects")
-
-selects.config_setting_group(
-    name = "aarch64-apple-darwin",
-    match_all = [
-        "@platforms//cpu:aarch64",
-        "@platforms//os:macos",
-    ],
-)
-
-selects.config_setting_group(
-    name = "aarch64-unknown-linux-gnu",
-    match_all = [
-        "@platforms//cpu:aarch64",
-        "@platforms//os:linux",
-        "@local-remote-execution//libc:glibc",
-    ],
-)
-
-selects.config_setting_group(
-    name = "aarch64-unknown-linux-musl",
-    match_all = [
-        "@platforms//cpu:aarch64",
-        "@platforms//os:linux",
-        "@local-remote-execution//libc:musl",
-    ],
-)
-
-selects.config_setting_group(
-    name = "x86_64-apple-darwin",
-    match_all = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:macos",
-    ],
-)
-
-selects.config_setting_group(
-    name = "x86_64-unknown-linux-gnu",
-    match_all = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:linux",
-        "@local-remote-execution//libc:glibc",
-    ],
-)
-
-selects.config_setting_group(
-    name = "x86_64-unknown-linux-musl",
-    match_all = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:linux",
-        "@local-remote-execution//libc:musl",
-    ],
-)
diff --git a/local-remote-execution/rust/x86_64-darwin.BUILD.bazel b/local-remote-execution/rust/x86_64-darwin.BUILD.bazel
deleted file mode 100644
index f88abc3e3..000000000
--- a/local-remote-execution/rust/x86_64-darwin.BUILD.bazel
+++ /dev/null
@@ -1,161 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file is @generated by lre-rs.
-
-"""Tool repository for lre-rs executing on x86_64-darwin."""
-
-load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
-
-[
-    filegroup(
-        name = tool,
-        srcs = [
-            "bin/{}".format(tool),
-        ],
-        visibility = ["//visibility:public"],
-    )
-    for tool in [
-        "rustc",
-        "rustfmt",
-        "cargo",
-        "cargo-clippy",
-        "clippy-driver",
-        "rustdoc",
-    ]
-]
-
-filegroup(
-    name = "rustc_lib",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-apple-darwin": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-apple-darwin/codegen-backends/*.so",
-                "lib/rustlib/aarch64-apple-darwin/lib/*.so",
-            ] + ["lib/rustlib/aarch64-apple-darwin/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-apple-darwin": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-apple-darwin/codegen-backends/*.so",
-                "lib/rustlib/x86_64-apple-darwin/lib/*.so",
-            ] + ["lib/rustlib/x86_64-apple-darwin/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
-
-rust_stdlib_filegroup(
-    name = "rust_std",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-apple-darwin": glob(
-            [
-                "lib/rustlib/aarch64-apple-darwin/lib/*.rlib",
-                "lib/rustlib/aarch64-apple-darwin/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-apple-darwin/lib/*.so",
-                "lib/rustlib/aarch64-apple-darwin/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-apple-darwin": glob(
-            [
-                "lib/rustlib/x86_64-apple-darwin/lib/*.rlib",
-                "lib/rustlib/x86_64-apple-darwin/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-apple-darwin/lib/*.so",
-                "lib/rustlib/x86_64-apple-darwin/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
diff --git a/local-remote-execution/rust/x86_64-linux.BUILD.bazel b/local-remote-execution/rust/x86_64-linux.BUILD.bazel
deleted file mode 100644
index 0e6aae951..000000000
--- a/local-remote-execution/rust/x86_64-linux.BUILD.bazel
+++ /dev/null
@@ -1,125 +0,0 @@
-# Copyright 2024 The NativeLink Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This file is @generated by lre-rs.
-
-"""Tool repository for lre-rs executing on x86_64-linux."""
-
-load("@rules_rust//rust:toolchain.bzl", "rust_stdlib_filegroup")
-
-[
-    filegroup(
-        name = tool,
-        srcs = [
-            "bin/{}".format(tool),
-        ],
-        visibility = ["//visibility:public"],
-    )
-    for tool in [
-        "rustc",
-        "rustfmt",
-        "cargo",
-        "cargo-clippy",
-        "clippy-driver",
-        "rustdoc",
-    ]
-]
-
-filegroup(
-    name = "rustc_lib",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/aarch64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld"],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "bin/*.so",
-                "lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/codegen-backends/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-            ] + ["lib/rustlib/x86_64-unknown-linux-musl/bin/rust-lld"],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
-
-rust_stdlib_filegroup(
-    name = "rust_std",
-    srcs = select({
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:aarch64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/aarch64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-gnu": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-gnu/lib/*.a",
-            ],
-            allow_empty = True,
-        ),
-        "@local-remote-execution//rust/triple:x86_64-unknown-linux-musl": glob(
-            [
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rlib",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.rmeta",  # See https://github.com/bazelbuild/rules_rust/issues/3859
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.so",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/*.a",
-                "lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained/**",
-            ],
-            allow_empty = True,
-        ),
-    }),
-    visibility = ["//visibility:public"],
-)
diff --git a/nativelink-worker/src/running_actions_manager.rs b/nativelink-worker/src/running_actions_manager.rs
index f0e5000fc..fc8a929e3 100644
--- a/nativelink-worker/src/running_actions_manager.rs
+++ b/nativelink-worker/src/running_actions_manager.rs
@@ -957,7 +957,15 @@ async fn do_cleanup(
         return Ok(());
     };
 
-    debug!("Worker cleaning up");
+    // Debug-only hack to not cleanup workers when we need to debug something
+    if !env::var("NATIVELINK_DONT_CLEANUP")
+        .unwrap_or_default()
+        .is_empty()
+    {
+        return Ok(());
+    }
+
+    debug!(?action_directory, "Worker cleaning up");
     // Note: We need to be careful to keep trying to cleanup even if one of the steps fails.
     let remove_dir_result = fs::remove_dir_all(action_directory)
         .await
@@ -1240,12 +1248,20 @@ impl RunningActionImpl {
         } else {
             command_proto.arguments.iter().map(AsRef::as_ref).collect()
         };
+        let command_directory = if command_proto.working_directory.is_empty() {
+            self.work_directory.clone()
+        } else {
+            format!(
+                "{}/{}",
+                self.work_directory, command_proto.working_directory
+            )
+        };
         // TODO(palfrey): This should probably be in debug, but currently
         //                    that's too busy and we often rely on this to
         //                    figure out toolchain misconfiguration issues.
         //                    De-bloat the `debug` level by using the `trace`
         //                    level more effectively and adjust this.
-        info!(?args, "Executing command");
+        info!(?args, ?command_directory, "Executing command");
 
         let program = self
             .canonicalise_path(args[0], &command_proto.working_directory)
@@ -1261,14 +1277,7 @@ impl RunningActionImpl {
                         request_id: 0,
                         cancel: false,
                         verbosity: 0,
-                        sandbox_dir: if command_proto.working_directory.is_empty() {
-                            self.work_directory.clone()
-                        } else {
-                            format!(
-                                "{}/{}",
-                                self.work_directory, command_proto.working_directory
-                            )
-                        },
+                        sandbox_dir: command_directory.clone(),
                     };
                     let worker_cwd =
                         PathBuf::from(&self.running_actions_manager.root_action_directory);
@@ -1379,10 +1388,7 @@ impl RunningActionImpl {
             .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
-            .current_dir(format!(
-                "{}/{}",
-                self.work_directory, command_proto.working_directory
-            ))
+            .current_dir(command_directory)
             .env_clear();
 
         let requested_timeout = if self.action_info.timeout.is_zero() {
diff --git a/templates/bazel/MODULE.bazel b/templates/bazel/MODULE.bazel
index a65d6c89d..9895b120a 100644
--- a/templates/bazel/MODULE.bazel
+++ b/templates/bazel/MODULE.bazel
@@ -13,4 +13,4 @@ archive_override(
     urls = ["https://github.com/TraceMachina/nativelink/archive/f9ff630e09a3c22d6a3abea68d1bacc775eac6bb.zip"],
 )
 
-bazel_dep(name = "rules_cc", version = "0.2.8")
+bazel_dep(name = "rules_cc", version = "0.2.18")
diff --git a/tools/public/create-worker.nix b/tools/public/create-worker.nix
index 23308f7e8..9725ef66d 100644
--- a/tools/public/create-worker.nix
+++ b/tools/public/create-worker.nix
@@ -5,7 +5,6 @@
     nix2container,
     coreutils,
     gnused,
-    lib,
     runCommand,
     runtimeShell,
     self,
@@ -31,25 +30,13 @@
       ln -s /bin/env $out/usr/bin/env
     '';
 
-    user = "nativelink";
-    group = "nativelink";
-    uid = "1000";
-    gid = "1000";
-
     mkUser = runCommand "mkUser" {} ''
       mkdir -p $out/etc/pam.d
 
       echo "root:x:0:0::/root:${runtimeShell}" > $out/etc/passwd
-      echo "${user}:x:${uid}:${gid}:::" >> $out/etc/passwd
-
       echo "root:!x:::::::" > $out/etc/shadow
-      echo "${user}:!x:::::::" >> $out/etc/shadow
-
       echo "root:x:0:" > $out/etc/group
-      echo "${group}:x:${gid}:" >> $out/etc/group
-
       echo "root:x::" > $out/etc/gshadow
-      echo "${group}:x::" >> $out/etc/gshadow
 
       cat > $out/etc/pam.d/other <<EOF
       account sufficient pam_unix.so
@@ -59,19 +46,7 @@
       EOF
 
       touch $out/etc/login.defs
-      mkdir -p $out/home/${user}
     '';
-
-    # Set permissions for the user's home directory.
-    mkUserPerms = {
-      path = mkUser;
-      regex = "/home/${user}";
-      mode = "0755";
-      uid = lib.toInt uid;
-      gid = lib.toInt gid;
-      uname = user;
-      gname = group;
-    };
   in
     # Create a container image from a base image with the nativelink executable
     # added and set as entrypoint. This allows arbitrary base images to be
@@ -93,7 +68,6 @@
         ];
 
         perms = [
-          mkUserPerms
           mkTmpPerms
         ];
 
@@ -103,8 +77,9 @@
         tag = image.imageTag;
 
         config = {
-          User = user;
-          WorkingDir = "/home/${user}";
+          # Need root so we can use namespaces
+          User = "root";
+          WorkingDir = "/root";
           Labels = {
             "org.opencontainers.image.description" = "NativeLink worker generated from ${image.imageName}.";
             "org.opencontainers.image.documentation" = "https://github.com/TraceMachina/nativelink";