diff --git a/.github/scripts/rusty_v8_bazel.py b/.github/scripts/rusty_v8_bazel.py
new file mode 100644
index 000000000..c11e67263
--- /dev/null
+++ b/.github/scripts/rusty_v8_bazel.py
@@ -0,0 +1,287 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import argparse
+import gzip
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import tomllib
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+MUSL_RUNTIME_ARCHIVE_LABELS = [
+    "@llvm//runtimes/libcxx:libcxx.static",
+    "@llvm//runtimes/libcxx:libcxxabi.static",
+]
+LLVM_AR_LABEL = "@llvm//tools:llvm-ar"
+LLVM_RANLIB_LABEL = "@llvm//tools:llvm-ranlib"
+
+
+def bazel_execroot() -> Path:
+    result = subprocess.run(
+        ["bazel", "info", "execution_root"],
+        cwd=ROOT,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return Path(result.stdout.strip())
+
+
+def bazel_output_base() -> Path:
+    result = subprocess.run(
+        ["bazel", "info", "output_base"],
+        cwd=ROOT,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return Path(result.stdout.strip())
+
+
+def bazel_output_path(path: str) -> Path:
+    if path.startswith("external/"):
+        return bazel_output_base() / path
+    return bazel_execroot() / path
+
+
+def bazel_output_files(
+    platform: str,
+    labels: list[str],
+    compilation_mode: str = "fastbuild",
+) -> list[Path]:
+    expression = "set(" + " ".join(labels) + ")"
+    result = subprocess.run(
+        [
+            "bazel",
+            "cquery",
+            "-c",
+            compilation_mode,
+            f"--platforms=@llvm//platforms:{platform}",
+            "--output=files",
+            expression,
+        ],
+        cwd=ROOT,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return [bazel_output_path(line.strip()) for line in result.stdout.splitlines() if line.strip()]
+
+
+def bazel_build(
+    platform: str,
+    labels: list[str],
+    compilation_mode: str = "fastbuild",
+) -> None:
+    subprocess.run(
+        [
+            "bazel",
+            "build",
+            "-c",
+            compilation_mode,
+            f"--platforms=@llvm//platforms:{platform}",
+            *labels,
+        ],
+        cwd=ROOT,
+        check=True,
+    )
+
+
+def ensure_bazel_output_files(
+    platform: str,
+    labels: list[str],
+    compilation_mode: str = "fastbuild",
+) -> list[Path]:
+    outputs = bazel_output_files(platform, labels, compilation_mode)
+    if all(path.exists() for path in outputs):
+        return outputs
+
+    bazel_build(platform, labels, compilation_mode)
+    outputs = bazel_output_files(platform, labels, compilation_mode)
+    missing = [str(path) for path in outputs if not path.exists()]
+    if missing:
+        raise SystemExit(f"missing built outputs for {labels}: {missing}")
+    return outputs
+
+
+def release_pair_label(target: str) -> str:
+    target_suffix = target.replace("-", "_")
+    return f"//third_party/v8:rusty_v8_release_pair_{target_suffix}"
+
+
+def resolved_v8_crate_version() -> str:
+    cargo_lock = tomllib.loads((ROOT / "codex-rs" / "Cargo.lock").read_text())
+    versions = sorted(
+        {
+            package["version"]
+            for package in cargo_lock["package"]
+            if package["name"] == "v8"
+        }
+    )
+    if len(versions) == 1:
+        return versions[0]
+    if len(versions) > 1:
+        raise SystemExit(f"expected exactly one resolved v8 version, found: {versions}")
+
+    module_bazel = (ROOT / "MODULE.bazel").read_text()
+    matches = sorted(
+        set(
+            re.findall(
+                r'https://static\.crates\.io/crates/v8/v8-([0-9]+\.[0-9]+\.[0-9]+)\.crate',
+                module_bazel,
+            )
+        )
+    )
+    if len(matches) != 1:
+        raise SystemExit(
+            "expected exactly one pinned v8 crate version in MODULE.bazel, "
+            f"found: {matches}"
+        )
+    return matches[0]
+
+
+def staged_archive_name(target: str, source_path: Path) -> str:
+    if source_path.suffix == ".lib":
+        return f"rusty_v8_release_{target}.lib.gz"
+    return f"librusty_v8_release_{target}.a.gz"
+
+
+def is_musl_archive_target(target: str, source_path: Path) -> bool:
+    return target.endswith("-unknown-linux-musl") and source_path.suffix == ".a"
+
+
+def single_bazel_output_file(
+    platform: str,
+    label: str,
+    compilation_mode: str = "fastbuild",
+) -> Path:
+    outputs = ensure_bazel_output_files(platform, [label], compilation_mode)
+    if len(outputs) != 1:
+        raise SystemExit(f"expected exactly one output for {label}, found {outputs}")
+    return outputs[0]
+
+
+def merged_musl_archive(
+    platform: str,
+    lib_path: Path,
+    compilation_mode: str = "fastbuild",
+) -> Path:
+    llvm_ar = single_bazel_output_file(platform, LLVM_AR_LABEL, compilation_mode)
+    llvm_ranlib = single_bazel_output_file(platform, LLVM_RANLIB_LABEL, compilation_mode)
+    runtime_archives = [
+        single_bazel_output_file(platform, label, compilation_mode)
+        for label in MUSL_RUNTIME_ARCHIVE_LABELS
+    ]
+
+    temp_dir = Path(tempfile.mkdtemp(prefix="rusty-v8-musl-stage-"))
+    merged_archive = temp_dir / lib_path.name
+    merge_commands = "\n".join(
+        [
+            f"create {merged_archive}",
+            f"addlib {lib_path}",
+            *[f"addlib {archive}" for archive in runtime_archives],
+            "save",
+            "end",
+        ]
+    )
+    subprocess.run(
+        [str(llvm_ar), "-M"],
+        cwd=ROOT,
+        check=True,
+        input=merge_commands,
+        text=True,
+    )
+    subprocess.run([str(llvm_ranlib), str(merged_archive)], cwd=ROOT, check=True)
+    return merged_archive
+
+
+def stage_release_pair(
+    platform: str,
+    target: str,
+    output_dir: Path,
+    compilation_mode: str = "fastbuild",
+) -> None:
+    outputs = ensure_bazel_output_files(
+        platform,
+        [release_pair_label(target)],
+        compilation_mode,
+    )
+
+    try:
+        lib_path = next(path for path in outputs if path.suffix in {".a", ".lib"})
+    except StopIteration as exc:
+        raise SystemExit(f"missing static library output for {target}") from exc
+
+    try:
+        binding_path = next(path for path in outputs if path.suffix == ".rs")
+    except StopIteration as exc:
+        raise SystemExit(f"missing Rust binding output for {target}") from exc
+
+    output_dir.mkdir(parents=True, exist_ok=True)
+    staged_library = output_dir / staged_archive_name(target, lib_path)
+    staged_binding = output_dir / f"src_binding_release_{target}.rs"
+    source_archive = (
+        merged_musl_archive(platform, lib_path, compilation_mode)
+        if is_musl_archive_target(target, lib_path)
+        else lib_path
+    )
+
+    with source_archive.open("rb") as src, staged_library.open("wb") as dst:
+        with gzip.GzipFile(
+            filename="",
+            mode="wb",
+            fileobj=dst,
+            compresslevel=6,
+            mtime=0,
+        ) as gz:
+            shutil.copyfileobj(src, gz)
+
+    shutil.copyfile(binding_path, staged_binding)
+
+    print(staged_library)
+    print(staged_binding)
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    stage_release_pair_parser = subparsers.add_parser("stage-release-pair")
+    stage_release_pair_parser.add_argument("--platform", required=True)
+    stage_release_pair_parser.add_argument("--target", required=True)
+    stage_release_pair_parser.add_argument("--output-dir", required=True)
+    stage_release_pair_parser.add_argument(
+        "--compilation-mode",
+        default="fastbuild",
+        choices=["fastbuild", "opt", "dbg"],
+    )
+
+    subparsers.add_parser("resolved-v8-crate-version")
+
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    if args.command == "stage-release-pair":
+        stage_release_pair(
+            platform=args.platform,
+            target=args.target,
+            output_dir=Path(args.output_dir),
+            compilation_mode=args.compilation_mode,
+        )
+        return 0
+    if args.command == "resolved-v8-crate-version":
+        print(resolved_v8_crate_version())
+        return 0
+    raise SystemExit(f"unsupported command: {args.command}")
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index 64e831e5f..b2ef107ca 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -156,7 +156,6 @@ jobs:
 
           bazel_args=(
             test
-            //...
             --test_verbose_timeout_warnings
             --build_metadata=REPO_URL=https://github.com/openai/codex.git
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
@@ -164,6 +163,13 @@ jobs:
             --build_metadata=VISIBILITY=PUBLIC
           )
 
+          bazel_targets=(
+            //...
+            # Keep V8 out of the ordinary Bazel CI path. Only the dedicated
+            # canary and release workflows should build `third_party/v8`.
+            -//third_party/v8:all
+          )
+
           if [[ "${RUNNER_OS:-}" != "Windows" ]]; then
             # Bazel test sandboxes on macOS may resolve an older Homebrew `node`
             # before the `actions/setup-node` runtime on PATH.
@@ -183,6 +189,8 @@ jobs:
               --bazelrc=.github/workflows/ci.bazelrc \
               "${bazel_args[@]}" \
               "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY" \
+              -- \
+              "${bazel_targets[@]}" \
               2>&1 | tee "$bazel_console_log"
             bazel_status=${PIPESTATUS[0]}
             set -e
@@ -210,6 +218,8 @@ jobs:
               "${bazel_args[@]}" \
               --remote_cache= \
               --remote_executor= \
+              -- \
+              "${bazel_targets[@]}" \
               2>&1 | tee "$bazel_console_log"
             bazel_status=${PIPESTATUS[0]}
             set -e
diff --git a/.github/workflows/rusty-v8-release.yml b/.github/workflows/rusty-v8-release.yml
new file mode 100644
index 000000000..bb191b88c
--- /dev/null
+++ b/.github/workflows/rusty-v8-release.yml
@@ -0,0 +1,188 @@
+name: rusty-v8-release
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Optional release tag. Defaults to rusty-v8-v<resolved_v8_version>.
+        required: false
+        type: string
+      publish:
+        description: Publish the staged musl artifacts to a GitHub release.
+        required: false
+        default: true
+        type: boolean
+
+concurrency:
+  group: ${{ github.workflow }}::${{ inputs.release_tag || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  metadata:
+    runs-on: ubuntu-latest
+    outputs:
+      release_tag: ${{ steps.release_tag.outputs.release_tag }}
+      v8_version: ${{ steps.v8_version.outputs.version }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Resolve exact v8 crate version
+        id: v8_version
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="$(python3 .github/scripts/rusty_v8_bazel.py resolved-v8-crate-version)"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve release tag
+        id: release_tag
+        env:
+          RELEASE_TAG_INPUT: ${{ inputs.release_tag }}
+          V8_VERSION: ${{ steps.v8_version.outputs.version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          release_tag="${RELEASE_TAG_INPUT}"
+          if [[ -z "${release_tag}" ]]; then
+            release_tag="rusty-v8-v${V8_VERSION}"
+          fi
+
+          echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build ${{ matrix.target }}
+    needs: metadata
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            platform: linux_amd64_musl
+            target: x86_64-unknown-linux-musl
+          - runner: ubuntu-24.04-arm
+            platform: linux_arm64_musl
+            target: aarch64-unknown-linux-musl
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Bazel
+        uses: bazelbuild/setup-bazelisk@v3
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Build Bazel V8 release pair
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+          PLATFORM: ${{ matrix.platform }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          target_suffix="${TARGET//-/_}"
+          pair_target="//third_party/v8:rusty_v8_release_pair_${target_suffix}"
+          extra_targets=()
+          if [[ "${TARGET}" == *-unknown-linux-musl ]]; then
+            extra_targets=(
+              "@llvm//runtimes/libcxx:libcxx.static"
+              "@llvm//runtimes/libcxx:libcxxabi.static"
+            )
+          fi
+
+          bazel_args=(
+            build
+            -c
+            opt
+            "--platforms=@llvm//platforms:${PLATFORM}"
+            "${pair_target}"
+            "${extra_targets[@]}"
+            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
+          )
+
+          bazel \
+            --noexperimental_remote_repo_contents_cache \
+            --bazelrc=.github/workflows/v8-ci.bazelrc \
+            "${bazel_args[@]}" \
+            "--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
+
+      - name: Stage release pair
+        env:
+          PLATFORM: ${{ matrix.platform }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair \
+            --platform "${PLATFORM}" \
+            --target "${TARGET}" \
+            --compilation-mode opt \
+            --output-dir "dist/${TARGET}"
+
+      - name: Upload staged musl artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: rusty-v8-${{ needs.metadata.outputs.v8_version }}-${{ matrix.target }}
+          path: dist/${{ matrix.target }}/*
+
+  publish-release:
+    if: ${{ inputs.publish }}
+    needs:
+      - metadata
+      - build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: read
+
+    steps:
+      - name: Ensure publishing from default branch
+        if: ${{ github.ref_name != github.event.repository.default_branch }}
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "Publishing is only allowed from ${DEFAULT_BRANCH}; current ref is ${GITHUB_REF_NAME}." >&2
+          exit 1
+
+      - name: Ensure release tag is new
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.metadata.outputs.release_tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" > /dev/null 2>&1; then
+            echo "Release tag ${RELEASE_TAG} already exists; musl artifact tags are immutable." >&2
+            exit 1
+          fi
+
+      - uses: actions/download-artifact@v8
+        with:
+          path: dist
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.metadata.outputs.release_tag }}
+          name: ${{ needs.metadata.outputs.release_tag }}
+          files: dist/**
+          # Keep V8 artifact releases out of Codex's normal "latest release" channel.
+          prerelease: true
diff --git a/.github/workflows/v8-canary.yml b/.github/workflows/v8-canary.yml
new file mode 100644
index 000000000..213c6a7b6
--- /dev/null
+++ b/.github/workflows/v8-canary.yml
@@ -0,0 +1,132 @@
+name: v8-canary
+
+on:
+  pull_request:
+    paths:
+      - ".github/scripts/rusty_v8_bazel.py"
+      - ".github/workflows/rusty-v8-release.yml"
+      - ".github/workflows/v8-canary.yml"
+      - "MODULE.bazel"
+      - "MODULE.bazel.lock"
+      - "codex-rs/Cargo.toml"
+      - "patches/BUILD.bazel"
+      - "patches/v8_*.patch"
+      - "third_party/v8/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/scripts/rusty_v8_bazel.py"
+      - ".github/workflows/rusty-v8-release.yml"
+      - ".github/workflows/v8-canary.yml"
+      - "MODULE.bazel"
+      - "MODULE.bazel.lock"
+      - "codex-rs/Cargo.toml"
+      - "patches/BUILD.bazel"
+      - "patches/v8_*.patch"
+      - "third_party/v8/**"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+jobs:
+  metadata:
+    runs-on: ubuntu-latest
+    outputs:
+      v8_version: ${{ steps.v8_version.outputs.version }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Resolve exact v8 crate version
+        id: v8_version
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="$(python3 .github/scripts/rusty_v8_bazel.py resolved-v8-crate-version)"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build ${{ matrix.target }}
+    needs: metadata
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            platform: linux_amd64_musl
+            target: x86_64-unknown-linux-musl
+          - runner: ubuntu-24.04-arm
+            platform: linux_arm64_musl
+            target: aarch64-unknown-linux-musl
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Bazel
+        uses: bazelbuild/setup-bazelisk@v3
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Build Bazel V8 release pair
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+          PLATFORM: ${{ matrix.platform }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          target_suffix="${TARGET//-/_}"
+          pair_target="//third_party/v8:rusty_v8_release_pair_${target_suffix}"
+          extra_targets=(
+            "@llvm//runtimes/libcxx:libcxx.static"
+            "@llvm//runtimes/libcxx:libcxxabi.static"
+          )
+
+          bazel_args=(
+            build
+            "--platforms=@llvm//platforms:${PLATFORM}"
+            "${pair_target}"
+            "${extra_targets[@]}"
+            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
+          )
+
+          bazel \
+            --noexperimental_remote_repo_contents_cache \
+            --bazelrc=.github/workflows/v8-ci.bazelrc \
+            "${bazel_args[@]}" \
+            "--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
+
+      - name: Stage release pair
+        env:
+          PLATFORM: ${{ matrix.platform }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair \
+            --platform "${PLATFORM}" \
+            --target "${TARGET}" \
+            --output-dir "dist/${TARGET}"
+
+      - name: Upload staged musl artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-${{ matrix.target }}
+          path: dist/${{ matrix.target }}/*
diff --git a/.github/workflows/v8-ci.bazelrc b/.github/workflows/v8-ci.bazelrc
new file mode 100644
index 000000000..df1b4bec3
--- /dev/null
+++ b/.github/workflows/v8-ci.bazelrc
@@ -0,0 +1,5 @@
+import %workspace%/.github/workflows/ci.bazelrc
+
+common --build_metadata=REPO_URL=https://github.com/openai/codex.git
+common --build_metadata=ROLE=CI
+common --build_metadata=VISIBILITY=PUBLIC
diff --git a/MODULE.bazel b/MODULE.bazel
index e6ad1c710..f6f0fd090 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,5 +1,6 @@
 module(name = "codex")
 
+bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "llvm", version = "0.6.7")
 
@@ -132,6 +133,8 @@ crate.annotation(
     workspace_cargo_toml = "rust/runfiles/Cargo.toml",
 )
 
+http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
 llvm = use_extension("@llvm//extensions:llvm.bzl", "llvm")
 use_repo(llvm, "llvm-project")
 
@@ -174,6 +177,29 @@ crate.annotation(
 
 inject_repo(crate, "alsa_lib")
 
+bazel_dep(name = "v8", version = "14.6.202.9")
+archive_override(
+    module_name = "v8",
+    integrity = "sha256-JphDwLAzsd9KvgRZ7eQvNtPU6qGd3XjFt/a/1QITAJU=",
+    patch_strip = 3,
+    patches = [
+        "//patches:v8_module_deps.patch",
+        "//patches:v8_bazel_rules.patch",
+        "//patches:v8_source_portability.patch",
+    ],
+    strip_prefix = "v8-14.6.202.9",
+    urls = ["https://github.com/v8/v8/archive/refs/tags/14.6.202.9.tar.gz"],
+)
+
+http_archive(
+    name = "v8_crate_146_4_0",
+    build_file = "//third_party/v8:v8_crate.BUILD.bazel",
+    sha256 = "d97bcac5cdc5a195a4813f1855a6bc658f240452aac36caa12fd6c6f16026ab1",
+    strip_prefix = "v8-146.4.0",
+    type = "tar.gz",
+    urls = ["https://static.crates.io/crates/v8/v8-146.4.0.crate"],
+)
+
 use_repo(crate, "crates")
 
 bazel_dep(name = "libcap", version = "2.27.bcr.1")
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index b37695679..2ee57d742 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -12,6 +12,7 @@
     "https://bcr.bazel.build/modules/abseil-cpp/20240116.2/MODULE.bazel": "73939767a4686cd9a520d16af5ab440071ed75cec1a876bf2fcfaf1f71987a16",
     "https://bcr.bazel.build/modules/abseil-cpp/20250127.1/MODULE.bazel": "c4a89e7ceb9bf1e25cf84a9f830ff6b817b72874088bf5141b314726e46a57c1",
     "https://bcr.bazel.build/modules/abseil-cpp/20250512.1/MODULE.bazel": "d209fdb6f36ffaf61c509fcc81b19e81b411a999a934a032e10cd009a0226215",
+    "https://bcr.bazel.build/modules/abseil-cpp/20250814.0/MODULE.bazel": "c43c16ca2c432566cdb78913964497259903ebe8fb7d9b57b38e9f1425b427b8",
     "https://bcr.bazel.build/modules/abseil-cpp/20250814.1/MODULE.bazel": "51f2312901470cdab0dbdf3b88c40cd21c62a7ed58a3de45b365ddc5b11bcab2",
     "https://bcr.bazel.build/modules/abseil-cpp/20250814.1/source.json": "cea3901d7e299da7320700abbaafe57a65d039f10d0d7ea601c4a66938ea4b0c",
     "https://bcr.bazel.build/modules/alsa_lib/1.2.9.bcr.4/MODULE.bazel": "66842efc2b50b7c12274a5218d468119a5d6f9dc46a5164d9496fb517f64aba6",
@@ -104,6 +105,7 @@
     "https://bcr.bazel.build/modules/platforms/1.0.0/source.json": "f4ff1fd412e0246fd38c82328eb209130ead81d62dcd5a9e40910f867f733d96",
     "https://bcr.bazel.build/modules/protobuf/21.7/MODULE.bazel": "a5a29bb89544f9b97edce05642fac225a808b5b7be74038ea3640fae2f8e66a7",
     "https://bcr.bazel.build/modules/protobuf/27.0/MODULE.bazel": "7873b60be88844a0a1d8f80b9d5d20cfbd8495a689b8763e76c6372998d3f64c",
+    "https://bcr.bazel.build/modules/protobuf/27.1/MODULE.bazel": "703a7b614728bb06647f965264967a8ef1c39e09e8f167b3ca0bb1fd80449c0d",
     "https://bcr.bazel.build/modules/protobuf/29.0-rc2/MODULE.bazel": "6241d35983510143049943fc0d57937937122baf1b287862f9dc8590fc4c37df",
     "https://bcr.bazel.build/modules/protobuf/29.0-rc3/MODULE.bazel": "33c2dfa286578573afc55a7acaea3cada4122b9631007c594bf0729f41c8de92",
     "https://bcr.bazel.build/modules/protobuf/29.1/MODULE.bazel": "557c3457560ff49e122ed76c0bc3397a64af9574691cb8201b4e46d4ab2ecb95",
@@ -167,6 +169,7 @@
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/MODULE.bazel": "d269a01a18ee74d0335450b10f62c9ed81f2321d7958a2934e44272fe82dcef3",
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/source.json": "2faa4794364282db7c06600b7e5e34867a564ae91bda7cae7c29c64e9466b7d5",
     "https://bcr.bazel.build/modules/rules_license/0.0.3/MODULE.bazel": "627e9ab0247f7d1e05736b59dbb1b6871373de5ad31c3011880b4133cafd4bd0",
+    "https://bcr.bazel.build/modules/rules_license/0.0.4/MODULE.bazel": "6a88dd22800cf1f9f79ba32cacad0d3a423ed28efa2c2ed5582eaa78dd3ac1e5",
     "https://bcr.bazel.build/modules/rules_license/0.0.7/MODULE.bazel": "088fbeb0b6a419005b89cf93fe62d9517c0a2b8bb56af3244af65ecfe37e7d5d",
     "https://bcr.bazel.build/modules/rules_license/1.0.0/MODULE.bazel": "a7fda60eefdf3d8c827262ba499957e4df06f659330bbe6cdbdb975b768bb65c",
     "https://bcr.bazel.build/modules/rules_license/1.0.0/source.json": "a52c89e54cc311196e478f8382df91c15f7a2bfdf4c6cd0e2675cc2ff0b56efb",
@@ -181,6 +184,7 @@
     "https://bcr.bazel.build/modules/rules_proto/5.3.0-21.7/MODULE.bazel": "e8dff86b0971688790ae75528fe1813f71809b5afd57facb44dad9e8eca631b7",
     "https://bcr.bazel.build/modules/rules_proto/6.0.0-rc1/MODULE.bazel": "1e5b502e2e1a9e825eef74476a5a1ee524a92297085015a052510b09a1a09483",
     "https://bcr.bazel.build/modules/rules_proto/6.0.2/MODULE.bazel": "ce916b775a62b90b61888052a416ccdda405212b6aaeb39522f7dc53431a5e73",
+    "https://bcr.bazel.build/modules/rules_proto/7.0.2/MODULE.bazel": "bf81793bd6d2ad89a37a40693e56c61b0ee30f7a7fdbaf3eabbf5f39de47dea2",
     "https://bcr.bazel.build/modules/rules_proto/7.1.0/MODULE.bazel": "002d62d9108f75bb807cd56245d45648f38275cb3a99dcd45dfb864c5d74cb96",
     "https://bcr.bazel.build/modules/rules_proto/7.1.0/source.json": "39f89066c12c24097854e8f57ab8558929f9c8d474d34b2c00ac04630ad8940e",
     "https://bcr.bazel.build/modules/rules_python/0.10.2/MODULE.bazel": "cc82bc96f2997baa545ab3ce73f196d040ffb8756fd2d66125a530031cd90e5f",
@@ -190,6 +194,7 @@
     "https://bcr.bazel.build/modules/rules_python/0.31.0/MODULE.bazel": "93a43dc47ee570e6ec9f5779b2e64c1476a6ce921c48cc9a1678a91dd5f8fd58",
     "https://bcr.bazel.build/modules/rules_python/0.33.2/MODULE.bazel": "3e036c4ad8d804a4dad897d333d8dce200d943df4827cb849840055be8d2e937",
     "https://bcr.bazel.build/modules/rules_python/0.4.0/MODULE.bazel": "9208ee05fd48bf09ac60ed269791cf17fb343db56c8226a720fbb1cdf467166c",
+    "https://bcr.bazel.build/modules/rules_python/1.0.0/MODULE.bazel": "898a3d999c22caa585eb062b600f88654bf92efb204fa346fb55f6f8edffca43",
     "https://bcr.bazel.build/modules/rules_python/1.3.0/MODULE.bazel": "8361d57eafb67c09b75bf4bbe6be360e1b8f4f18118ab48037f2bd50aa2ccb13",
     "https://bcr.bazel.build/modules/rules_python/1.4.1/MODULE.bazel": "8991ad45bdc25018301d6b7e1d3626afc3c8af8aaf4bc04f23d0b99c938b73a6",
     "https://bcr.bazel.build/modules/rules_python/1.6.0/MODULE.bazel": "7e04ad8f8d5bea40451cf80b1bd8262552aa73f841415d20db96b7241bd027d8",
diff --git a/patches/BUILD.bazel b/patches/BUILD.bazel
index e69de29bb..339c54a65 100644
--- a/patches/BUILD.bazel
+++ b/patches/BUILD.bazel
@@ -0,0 +1,7 @@
+exports_files([
+    "aws-lc-sys_memcmp_check.patch",
+    "v8_bazel_rules.patch",
+    "v8_module_deps.patch",
+    "v8_source_portability.patch",
+    "windows-link.patch",
+])
diff --git a/patches/v8_bazel_rules.patch b/patches/v8_bazel_rules.patch
new file mode 100644
index 000000000..0596ea839
--- /dev/null
+++ b/patches/v8_bazel_rules.patch
@@ -0,0 +1,227 @@
+# What: adapt upstream V8 Bazel rules to this workspace's hermetic toolchains
+# and externally provided dependencies.
+# Scope: Bazel BUILD/defs/BUILD.icu integration only, including dependency
+# wiring, generated sources, and visibility; no standalone V8 source patching.
+
+diff --git a/orig/v8-14.6.202.11/bazel/defs.bzl b/mod/v8-14.6.202.11/bazel/defs.bzl
+index 9648e4a..88efd41 100644
+--- a/orig/v8-14.6.202.11/bazel/defs.bzl
++++ b/mod/v8-14.6.202.11/bazel/defs.bzl
+@@ -97,7 +97,7 @@ v8_config = rule(
+ 
+ def _default_args():
+     return struct(
+-        deps = [":define_flags", "@libcxx//:libc++"],
++        deps = [":define_flags"],
+         defines = select({
+             "@v8//bazel/config:is_windows": [
+                 "UNICODE",
+@@ -128,12 +128,6 @@ def _default_args():
+             ],
+             "//conditions:default": [],
+         }) + select({
+-            "@v8//bazel/config:is_clang": [
+-                "-Wno-invalid-offsetof",
+-                "-Wno-deprecated-this-capture",
+-                "-Wno-deprecated-declarations",
+-                "-std=c++20",
+-            ],
+             "@v8//bazel/config:is_gcc": [
+                 "-Wno-extra",
+                 "-Wno-array-bounds",
+@@ -155,7 +149,12 @@ def _default_args():
+             "@v8//bazel/config:is_windows": [
+                 "/std:c++20",
+             ],
+-            "//conditions:default": [],
++            "//conditions:default": [
++                "-Wno-invalid-offsetof",
++                "-Wno-deprecated-this-capture",
++                "-Wno-deprecated-declarations",
++                "-std=c++20",
++            ],
+         }) + select({
+             "@v8//bazel/config:is_gcc_fastbuild": [
+                 # Non-debug builds without optimizations fail because
+@@ -184,7 +183,7 @@ def _default_args():
+                 "Advapi32.lib",
+             ],
+             "@v8//bazel/config:is_macos": ["-pthread"],
+-            "//conditions:default": ["-Wl,--no-as-needed -ldl -latomic -pthread"],
++            "//conditions:default": ["-Wl,--no-as-needed -ldl -pthread"],
+         }) + select({
+             ":should_add_rdynamic": ["-rdynamic"],
+             "//conditions:default": [],
+diff --git a/orig/v8-14.6.202.11/BUILD.bazel b/mod/v8-14.6.202.11/BUILD.bazel
+index 85f31b7..7314584 100644
+--- a/orig/v8-14.6.202.11/BUILD.bazel
++++ b/mod/v8-14.6.202.11/BUILD.bazel
+@@ -303,7 +303,7 @@ v8_int(
+ # If no explicit value for v8_enable_pointer_compression, we set it to 'none'.
+ v8_string(
+     name = "v8_enable_pointer_compression",
+-    default = "none",
++    default = "False",
+ )
+ 
+ # Default setting for v8_enable_pointer_compression.
+@@ -4077,28 +4077,14 @@ filegroup(
+     }),
+ )
+ 
+-v8_library(
+-  name = "lib_dragonbox",
+-  srcs = ["third_party/dragonbox/src/include/dragonbox/dragonbox.h"],
+-  hdrs = [
+-    "third_party/dragonbox/src/include/dragonbox/dragonbox.h",
+-  ],
+-  includes = [
+-    "third_party/dragonbox/src/include",
+-  ],
++alias(
++    name = "lib_dragonbox",
++    actual = "@dragonbox//:dragonbox",
+ )
+ 
+-v8_library(
+-  name = "lib_fp16",
+-  srcs = ["third_party/fp16/src/include/fp16.h"],
+-  hdrs = [
+-    "third_party/fp16/src/include/fp16/fp16.h",
+-    "third_party/fp16/src/include/fp16/bitcasts.h",
+-    "third_party/fp16/src/include/fp16/macros.h",
+-  ],
+-  includes = [
+-    "third_party/fp16/src/include",
+-  ],
++alias(
++    name = "lib_fp16",
++    actual = "@fp16//:fp16",
+ )
+ 
+ filegroup(
+@@ -4405,6 +4391,20 @@ genrule(
+     srcs = [
+         "include/js_protocol.pdl",
+         "src/inspector/inspector_protocol_config.json",
++        "third_party/inspector_protocol/code_generator.py",
++        "third_party/inspector_protocol/pdl.py",
++        "third_party/inspector_protocol/lib/Forward_h.template",
++        "third_party/inspector_protocol/lib/Object_cpp.template",
++        "third_party/inspector_protocol/lib/Object_h.template",
++        "third_party/inspector_protocol/lib/Protocol_cpp.template",
++        "third_party/inspector_protocol/lib/ValueConversions_cpp.template",
++        "third_party/inspector_protocol/lib/ValueConversions_h.template",
++        "third_party/inspector_protocol/lib/Values_cpp.template",
++        "third_party/inspector_protocol/lib/Values_h.template",
++        "third_party/inspector_protocol/templates/Exported_h.template",
++        "third_party/inspector_protocol/templates/Imported_h.template",
++        "third_party/inspector_protocol/templates/TypeBuilder_cpp.template",
++        "third_party/inspector_protocol/templates/TypeBuilder_h.template",
+     ],
+     outs = [
+         "include/inspector/Debugger.h",
+@@ -4426,15 +4426,19 @@ genrule(
+         "src/inspector/protocol/Schema.cpp",
+         "src/inspector/protocol/Schema.h",
+     ],
+-    cmd = "$(location :code_generator) --jinja_dir . \
+-           --inspector_protocol_dir third_party/inspector_protocol \
++    cmd = "INSPECTOR_PROTOCOL_DIR=$$(dirname $(execpath third_party/inspector_protocol/code_generator.py)); \
++           PYTHONPATH=$$INSPECTOR_PROTOCOL_DIR:external/rules_python++pip+v8_python_deps_311_jinja2/site-packages:external/rules_python++pip+v8_python_deps_311_markupsafe/site-packages:$${PYTHONPATH-} \
++           $(execpath @rules_python//python/bin:python) $(execpath third_party/inspector_protocol/code_generator.py) --jinja_dir . \
++           --inspector_protocol_dir $$INSPECTOR_PROTOCOL_DIR \
+            --config $(location :src/inspector/inspector_protocol_config.json) \
+            --config_value protocol.path=$(location :include/js_protocol.pdl) \
+            --output_base $(@D)/src/inspector",
+     local = 1,
+     message = "Generating inspector files",
+     tools = [
+-        ":code_generator",
++        "@rules_python//python/bin:python",
++        requirement("jinja2"),
++        requirement("markupsafe"),
+     ],
+ )
+ 
+@@ -4448,6 +4451,15 @@ filegroup(
+     ],
+ )
+ 
++cc_library(
++    name = "rusty_v8_internal_headers",
++    hdrs = [
++        "src/libplatform/default-platform.h",
++    ],
++    strip_include_prefix = "",
++    visibility = ["//visibility:public"],
++)
++
+ filegroup(
+     name = "d8_files",
+     srcs = [
+@@ -4567,16 +4579,9 @@ cc_library(
+     ],
+ )
+ 
+-cc_library(
+-  name = "simdutf",
+-  srcs = ["third_party/simdutf/simdutf.cpp"],
+-  hdrs = ["third_party/simdutf/simdutf.h"],
+-  copts = select({
+-        "@v8//bazel/config:is_clang": ["-std=c++20"],
+-        "@v8//bazel/config:is_gcc": ["-std=gnu++2a"],
+-        "@v8//bazel/config:is_windows": ["/std:c++20"],
+-        "//conditions:default": [],
+-    }),
++alias(
++    name = "simdutf",
++    actual = "@simdutf//:simdutf",
+ )
+ 
+ v8_library(
+@@ -4593,7 +4598,7 @@ v8_library(
+     copts = ["-Wno-implicit-fallthrough"],
+     icu_deps = [
+         ":icu/generated_torque_definitions_headers",
+-        "//external:icu",
++        "@icu//:icu",
+     ],
+     icu_srcs = [
+         ":generated_regexp_special_case",
+@@ -4608,7 +4613,7 @@ v8_library(
+     ],
+     deps = [
+         ":lib_dragonbox",
+-        "//third_party/fast_float/src:fast_float",
++        "@fast_float//:fast_float",
+         ":lib_fp16",
+         ":simdutf",
+         ":v8_libbase",
+@@ -4664,6 +4669,7 @@ alias(
+ alias(
+     name = "core_lib_icu",
+     actual = "icu/v8",
++    visibility = ["//visibility:public"],
+ )
+ 
+ v8_library(
+@@ -4715,7 +4721,7 @@ v8_binary(
+     ],
+     deps = [
+         ":v8_libbase",
+-        "//external:icu",
++        "@icu//:icu",
+     ],
+ )
+ 
+diff --git a/orig/v8-14.6.202.11/bazel/BUILD.icu b/mod/v8-14.6.202.11/bazel/BUILD.icu
+index 5fda2f4..381386c 100644
+--- a/orig/v8-14.6.202.11/bazel/BUILD.icu
++++ b/mod/v8-14.6.202.11/bazel/BUILD.icu
+@@ -1,3 +1,5 @@
++load("@rules_cc//cc:defs.bzl", "cc_library")
++
+ # Copyright 2021 the V8 project authors. All rights reserved.
+ # Use of this source code is governed by a BSD-style license that can be
+ # found in the LICENSE file.
diff --git a/patches/v8_module_deps.patch b/patches/v8_module_deps.patch
new file mode 100644
index 000000000..ec4c8afb2
--- /dev/null
+++ b/patches/v8_module_deps.patch
@@ -0,0 +1,256 @@
+# What: replace upstream V8 module dependency bootstrapping with repository
+# declarations and dependency setup that match this Bazel workspace.
+# Scope: upstream MODULE.bazel only; affects external repo resolution and Bazel
+# module wiring, not V8 source files.
+
+diff --git a/orig/v8-14.6.202.11/MODULE.bazel b/mod/v8-14.6.202.11/MODULE.bazel
+--- a/orig/v8-14.6.202.11/MODULE.bazel
++++ b/mod/v8-14.6.202.11/MODULE.bazel
+@@ -8,7 +8,57 @@
+ bazel_dep(name = "rules_python", version = "1.0.0")
+ bazel_dep(name = "platforms", version = "1.0.0")
+ bazel_dep(name = "abseil-cpp", version = "20250814.0")
+-bazel_dep(name = "highway", version = "1.2.0")
++bazel_dep(name = "rules_license", version = "0.0.4")
++
++git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
++http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
++
++http_archive(
++    name = "highway",
++    patch_args = ["-p1"],
++    patches = ["@v8//:bazel/highway.patch"],
++    sha256 = "7e0be78b8318e8bdbf6fa545d2ecb4c90f947df03f7aadc42c1967f019e63343",
++    strip_prefix = "highway-1.2.0",
++    urls = ["https://github.com/google/highway/archive/refs/tags/1.2.0.tar.gz"],
++)
++
++git_repository(
++    name = "icu",
++    build_file = "@v8//:bazel/BUILD.icu",
++    commit = "a86a32e67b8d1384b33f8fa48c83a6079b86f8cd",
++    patch_cmds = ["find source -name BUILD.bazel | xargs rm"],
++    patch_cmds_win = ["Get-ChildItem -Path source -File -Include BUILD.bazel -Recurse | Remove-Item"],
++    remote = "https://chromium.googlesource.com/chromium/deps/icu.git",
++)
++
++http_archive(
++    name = "fast_float",
++    build_file_content = 'load("@rules_cc//cc:defs.bzl", "cc_library")\n\ncc_library(\n    name = "fast_float",\n    hdrs = glob(["include/fast_float/*.h"]),\n    include_prefix = "third_party/fast_float/src/include",\n    strip_include_prefix = "include",\n    visibility = ["//visibility:public"],\n)\n',
++    sha256 = "e14a33089712b681d74d94e2a11362643bd7d769ae8f7e7caefe955f57f7eacd",
++    strip_prefix = "fast_float-8.0.2",
++    urls = ["https://github.com/fastfloat/fast_float/archive/refs/tags/v8.0.2.tar.gz"],
++)
++
++git_repository(
++    name = "simdutf",
++    build_file_content = 'load("@rules_cc//cc:defs.bzl", "cc_library")\n\ncc_library(\n    name = "simdutf",\n    srcs = ["simdutf.cpp"],\n    hdrs = ["simdutf.h"],\n    copts = ["-std=c++20"],\n    include_prefix = "third_party/simdutf",\n    visibility = ["//visibility:public"],\n)\n',
++    commit = "93b35aec29256f705c97f675fe4623578bd7a395",
++    remote = "https://chromium.googlesource.com/chromium/src/third_party/simdutf",
++)
++
++git_repository(
++    name = "dragonbox",
++    build_file_content = 'load("@rules_cc//cc:defs.bzl", "cc_library")\n\ncc_library(\n    name = "dragonbox",\n    hdrs = ["include/dragonbox/dragonbox.h"],\n    include_prefix = "third_party/dragonbox/src/include",\n    strip_include_prefix = "include",\n    visibility = ["//visibility:public"],\n)\n',
++    commit = "beeeef91cf6fef89a4d4ba5e95d47ca64ccb3a44",
++    remote = "https://chromium.googlesource.com/external/github.com/jk-jeon/dragonbox.git",
++)
++
++git_repository(
++    name = "fp16",
++    build_file_content = 'load("@rules_cc//cc:defs.bzl", "cc_library")\n\ncc_library(\n    name = "fp16",\n    hdrs = glob(["include/**/*.h"]),\n    include_prefix = "third_party/fp16/src/include",\n    includes = ["include"],\n    strip_include_prefix = "include",\n    visibility = ["//visibility:public"],\n)\n',
++    commit = "3d2de1816307bac63c16a297e8c4dc501b4076df",
++    remote = "https://chromium.googlesource.com/external/github.com/Maratyszcza/FP16.git",
++)
+
+ pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+ pip.parse(
+@@ -22,171 +72,3 @@
+ )
+ use_repo(pip, "v8_python_deps")
+ 
+-# Define the local LLVM toolchain repository
+-llvm_toolchain_repository = use_repo_rule("//bazel/toolchain:llvm_repository.bzl", "llvm_toolchain_repository")
+-
+-llvm_toolchain_repository(
+-    name = "llvm_toolchain",
+-    path = "third_party/llvm-build/Release+Asserts",
+-    config_file_content = """
+-load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool_path")
+-
+-def _impl(ctx):
+-    tool_paths = [
+-        tool_path(name = "gcc", path = "bin/clang"),
+-        tool_path(name = "ld", path = "bin/lld"),
+-        tool_path(name = "ar", path = "bin/llvm-ar"),
+-        tool_path(name = "cpp", path = "bin/clang++"),
+-        tool_path(name = "gcov", path = "/bin/false"),
+-        tool_path(name = "nm", path = "bin/llvm-nm"),
+-        tool_path(name = "objdump", path = "bin/llvm-objdump"),
+-        tool_path(name = "strip", path = "bin/llvm-strip"),
+-    ]
+-
+-    features = [
+-        feature(
+-            name = "default_compile_flags",
+-            enabled = True,
+-            flag_sets = [
+-                flag_set(
+-                    actions = [
+-                        "c-compile",
+-                        "c++-compile",
+-                        "c++-header-parsing",
+-                        "c++-module-compile",
+-                        "c++-module-codegen",
+-                        "linkstamp-compile",
+-                        "assemble",
+-                        "preprocess-assemble",
+-                    ],
+-                    flag_groups = [
+-                        flag_group(
+-                            flags = [
+-                                "--sysroot={WORKSPACE_ROOT}/build/linux/debian_bullseye_amd64-sysroot",
+-                                "-nostdinc++",
+-                                "-isystem",
+-                                "{WORKSPACE_ROOT}/buildtools/third_party/libc++",
+-                                "-isystem",
+-                                "{WORKSPACE_ROOT}/third_party/libc++/src/include",
+-                                "-isystem",
+-                                "{WORKSPACE_ROOT}/third_party/libc++abi/src/include",
+-                                "-isystem",
+-                                "{WORKSPACE_ROOT}/third_party/libc++/src/src",
+-                                "-isystem",
+-                                "{WORKSPACE_ROOT}/third_party/llvm-libc/src",
+-                                "-D_LIBCPP_HARDENING_MODE_DEFAULT=_LIBCPP_HARDENING_MODE_NONE",
+-                                "-DLIBC_NAMESPACE=__llvm_libc_cr",
+-                            ],
+-                        ),
+-                    ],
+-                ),
+-            ],
+-        ),
+-        feature(
+-            name = "default_linker_flags",
+-            enabled = True,
+-            flag_sets = [
+-                flag_set(
+-                    actions = [
+-                        "c++-link-executable",
+-                        "c++-link-dynamic-library",
+-                        "c++-link-nodeps-dynamic-library",
+-                    ],
+-                    flag_groups = [
+-                        flag_group(
+-                            flags = [
+-                                "--sysroot={WORKSPACE_ROOT}/build/linux/debian_bullseye_amd64-sysroot",
+-                                "-fuse-ld=lld",
+-                                "-lm",
+-                                "-lpthread",
+-                            ],
+-                        ),
+-                    ],
+-                ),
+-            ],
+-        ),
+-    ]
+-
+-    return cc_common.create_cc_toolchain_config_info(
+-        ctx = ctx,
+-        features = features,
+-        cxx_builtin_include_directories = [
+-            "{WORKSPACE_ROOT}/buildtools/third_party/libc++",
+-            "{WORKSPACE_ROOT}/third_party/libc++/src/include",
+-            "{WORKSPACE_ROOT}/third_party/libc++abi/src/include",
+-            "{WORKSPACE_ROOT}/third_party/libc++/src/src",
+-            "{WORKSPACE_ROOT}/third_party/llvm-libc/src",
+-            "{WORKSPACE_ROOT}/third_party/llvm-build/Release+Asserts/lib/clang/22/include",
+-            "{WORKSPACE_ROOT}/third_party/llvm-build/Release+Asserts/lib/clang/23/include",
+-            "{WORKSPACE_ROOT}/build/linux/debian_bullseye_amd64-sysroot/usr/include",
+-            "{WORKSPACE_ROOT}/build/linux/debian_bullseye_amd64-sysroot/usr/local/include",
+-        ],
+-        toolchain_identifier = "local_clang",
+-        host_system_name = "local",
+-        target_system_name = "local",
+-        target_cpu = "k8",
+-        target_libc = "unknown",
+-        compiler = "clang",
+-        abi_version = "unknown",
+-        abi_libc_version = "unknown",
+-        tool_paths = tool_paths,
+-    )
+-
+-cc_toolchain_config = rule(
+-    implementation = _impl,
+-    attrs = {},
+-    provides = [CcToolchainConfigInfo],
+-)
+-""",
+-    build_file_content = """
+-load(":cc_toolchain_config.bzl", "cc_toolchain_config")
+-
+-package(default_visibility = ["//visibility:public"])
+-
+-filegroup(
+-    name = "all_files",
+-    srcs = glob(["**/*"]),
+-)
+-
+-filegroup(name = "empty")
+-
+-cc_toolchain_config(name = "k8_toolchain_config")
+-
+-cc_toolchain(
+-    name = "k8_toolchain",
+-    all_files = ":all_files",
+-    ar_files = ":all_files",
+-    compiler_files = ":all_files",
+-    dwp_files = ":empty",
+-    linker_files = ":all_files",
+-    objcopy_files = ":all_files",
+-    strip_files = ":all_files",
+-    supports_param_files = 0,
+-    toolchain_config = ":k8_toolchain_config",
+-    toolchain_identifier = "local_clang",
+-)
+-
+-toolchain(
+-    name = "cc_toolchain_k8",
+-    exec_compatible_with = [
+-        "@platforms//cpu:x86_64",
+-        "@platforms//os:linux",
+-    ],
+-    target_compatible_with = [
+-        "@platforms//cpu:x86_64",
+-        "@platforms//os:linux",
+-    ],
+-    toolchain = ":k8_toolchain",
+-    toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
+-)
+-""",
+-)
+-
+-register_toolchains("@llvm_toolchain//:cc_toolchain_k8")
+-
+-# Define local repository for libc++ from third_party sources
+-libcxx_repository = use_repo_rule("//bazel/toolchain:libcxx_repository.bzl", "libcxx_repository")
+-
+-libcxx_repository(
+-    name = "libcxx",
+-)
+diff --git a/orig/v8-14.6.202.11/bazel/highway.patch b/mod/v8-14.6.202.11/bazel/highway.patch
+new file mode 100644
+--- /dev/null
++++ b/mod/v8-14.6.202.11/bazel/highway.patch
+@@ -0,0 +1,12 @@
++diff --git a/BUILD b/BUILD
++--- a/BUILD
+++++ b/BUILD
++@@ -2,7 +2,7 @@
++ load("@bazel_skylib//lib:selects.bzl", "selects")
++ load("@rules_license//rules:license.bzl", "license")
++
++-load("@rules_cc//cc:defs.bzl", "cc_test")
+++load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_test")
++ # Placeholder#2 for Guitar, do not remove
++
++ package(
diff --git a/patches/v8_source_portability.patch b/patches/v8_source_portability.patch
new file mode 100644
index 000000000..81433cae6
--- /dev/null
+++ b/patches/v8_source_portability.patch
@@ -0,0 +1,78 @@
+# What: make upstream V8 sources build cleanly in this hermetic toolchain setup.
+# Scope: minimal source-level portability fixes only, such as libexecinfo guards,
+# weak glibc symbol handling, and warning annotations; no dependency
+# include-path rewrites or intentional V8 feature changes.
+
+diff --git a/orig/v8-14.6.202.11/src/base/debug/stack_trace_posix.cc b/mod/v8-14.6.202.11/src/base/debug/stack_trace_posix.cc
+index 6176ed4..a02043d 100644
+--- a/orig/v8-14.6.202.11/src/base/debug/stack_trace_posix.cc
++++ b/mod/v8-14.6.202.11/src/base/debug/stack_trace_posix.cc
+@@ -64,6 +64,7 @@ namespace {
+ volatile sig_atomic_t in_signal_handler = 0;
+ bool dump_stack_in_signal_handler = true;
+ 
++#if HAVE_EXECINFO_H
+ // The prefix used for mangled symbols, per the Itanium C++ ABI:
+ // http://www.codesourcery.com/cxx-abi/abi.html#mangling
+ const char kMangledSymbolPrefix[] = "_Z";
+@@ -73,7 +74,6 @@ const char kMangledSymbolPrefix[] = "_Z";
+ const char kSymbolCharacters[] =
+     "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_";
+ 
+-#if HAVE_EXECINFO_H
+ // Demangles C++ symbols in the given text. Example:
+ //
+ // "out/Debug/base_unittests(_ZN10StackTraceC1Ev+0x20) [0x817778c]"
+
+diff --git a/orig/v8-14.6.202.11/src/base/platform/platform-posix.cc b/mod/v8-14.6.202.11/src/base/platform/platform-posix.cc
+index 4c7d878..0e45eb3 100644
+--- a/orig/v8-14.6.202.11/src/base/platform/platform-posix.cc
++++ b/mod/v8-14.6.202.11/src/base/platform/platform-posix.cc
+@@ -95,7 +95,7 @@
+ #endif
+
+ #if defined(V8_LIBC_GLIBC)
+-extern "C" void* __libc_stack_end;
++extern "C" void* __libc_stack_end V8_WEAK;
+ #endif
+
+ namespace v8 {
+@@ -1461,10 +1461,13 @@
+     // pthread_getattr_np can fail for the main thread.
+     // For the main thread we prefer using __libc_stack_end (if it exists) since
+     // it generally provides a tighter limit for CSS.
+-    return __libc_stack_end;
++    if (__libc_stack_end != nullptr) {
++      return __libc_stack_end;
++    }
+ #else
+     return nullptr;
+ #endif  // !defined(V8_LIBC_GLIBC)
++    return nullptr;
+   }
+   void* base;
+   size_t size;
+@@ -1476,7 +1479,8 @@
+   // __libc_stack_end is process global and thus is only valid for
+   // the main thread. Check whether this is the main thread by checking
+   // __libc_stack_end is within the thread's stack.
+-  if ((base <= __libc_stack_end) && (__libc_stack_end <= stack_start)) {
++  if (__libc_stack_end != nullptr &&
++      (base <= __libc_stack_end) && (__libc_stack_end <= stack_start)) {
+     DCHECK(MainThreadIsCurrentThread());
+     return __libc_stack_end;
+   }
+
+diff --git a/orig/v8-14.6.202.11/src/libplatform/default-thread-isolated-allocator.cc b/mod/v8-14.6.202.11/src/libplatform/default-thread-isolated-allocator.cc
+index bda0e43..b44f1d9 100644
+--- a/orig/v8-14.6.202.11/src/libplatform/default-thread-isolated-allocator.cc
++++ b/mod/v8-14.6.202.11/src/libplatform/default-thread-isolated-allocator.cc
+@@ -23,7 +23,7 @@ extern int pkey_free(int pkey) V8_WEAK;
+ 
+ namespace {
+ 
+-bool KernelHasPkruFix() {
++[[maybe_unused]] bool KernelHasPkruFix() {
+   // PKU was broken on Linux kernels before 5.13 (see
+   // https://lore.kernel.org/all/20210623121456.399107624@linutronix.de/).
+   // A fix is also included in the 5.4.182 and 5.10.103 versions ("x86/fpu:
diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
new file mode 100644
index 000000000..cfdbabf46
--- /dev/null
+++ b/third_party/v8/BUILD.bazel
@@ -0,0 +1,241 @@
+load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
+load("@rules_cc//cc:cc_static_library.bzl", "cc_static_library")
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+package(default_visibility = ["//visibility:public"])
+
+V8_COPTS = ["-std=c++20"]
+
+V8_STATIC_LIBRARY_FEATURES = [
+    "-symbol_check",
+    "-validate-static-library",
+]
+
+genrule(
+    name = "binding_cc",
+    srcs = ["@v8_crate_146_4_0//:binding_cc"],
+    outs = ["binding.cc"],
+    cmd = """
+      sed \
+        -e '/#include "v8\\/src\\/flags\\/flags.h"/d' \
+        -e 's|"v8/src/libplatform/default-platform.h"|"src/libplatform/default-platform.h"|' \
+        -e 's|  namespace i = v8::internal;|  (void)usage;|' \
+        -e '/using HelpOptions = i::FlagList::HelpOptions;/d' \
+        -e '/HelpOptions help_options = HelpOptions(HelpOptions::kExit, usage);/d' \
+        -e 's|  i::FlagList::SetFlagsFromCommandLine(argc, argv, true, help_options);|  v8::V8::SetFlagsFromCommandLine(argc, argv, true);|' \
+        $(location @v8_crate_146_4_0//:binding_cc) > "$@"
+    """,
+)
+
+copy_file(
+    name = "support_h",
+    src = "@v8_crate_146_4_0//:support_h",
+    out = "support.h",
+)
+
+cc_library(
+    name = "v8_146_4_0_binding",
+    srcs = [":binding_cc"],
+    hdrs = [":support_h"],
+    copts = V8_COPTS,
+    deps = [
+        "@v8//:core_lib_icu",
+        "@v8//:rusty_v8_internal_headers",
+    ],
+)
+
+cc_static_library(
+    name = "v8_146_4_0_x86_64_apple_darwin",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_146_4_0_aarch64_apple_darwin",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_146_4_0_aarch64_unknown_linux_gnu",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_146_4_0_x86_64_unknown_linux_gnu",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_146_4_0_aarch64_unknown_linux_musl_base",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+genrule(
+    name = "v8_146_4_0_aarch64_unknown_linux_musl",
+    srcs = [
+        ":v8_146_4_0_aarch64_unknown_linux_musl_base",
+        "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
+    ],
+    tools = [
+        "@llvm//tools:llvm-ar",
+        "@llvm//tools:llvm-ranlib",
+    ],
+    outs = ["libv8_146_4_0_aarch64_unknown_linux_musl.a"],
+    cmd = """
+      cat > "$(@D)/merge.mri" <<'EOF'
+create $@
+addlib $(location :v8_146_4_0_aarch64_unknown_linux_musl_base)
+addlib $(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static)
+save
+end
+EOF
+      $(location @llvm//tools:llvm-ar) -M < "$(@D)/merge.mri"
+      $(location @llvm//tools:llvm-ranlib) "$@"
+    """,
+)
+
+cc_static_library(
+    name = "v8_146_4_0_x86_64_unknown_linux_musl",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_146_4_0_aarch64_pc_windows_msvc",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_146_4_0_x86_64_pc_windows_msvc",
+    deps = [":v8_146_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+alias(
+    name = "v8_146_4_0_aarch64_pc_windows_gnullvm",
+    actual = ":v8_146_4_0_aarch64_pc_windows_msvc",
+)
+
+alias(
+    name = "v8_146_4_0_x86_64_pc_windows_gnullvm",
+    actual = ":v8_146_4_0_x86_64_pc_windows_msvc",
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_apple_darwin",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_apple_darwin"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_apple_darwin",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_aarch64_apple_darwin"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_unknown_linux_gnu",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_aarch64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_unknown_linux_gnu",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_unknown_linux_musl",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_aarch64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_unknown_linux_musl",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_pc_windows_msvc",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_pc_windows_msvc"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_pc_windows_msvc",
+    srcs = ["@v8_crate_146_4_0//:src_binding_release_aarch64_pc_windows_msvc"],
+)
+
+alias(
+    name = "src_binding_release_x86_64_pc_windows_gnullvm",
+    actual = ":src_binding_release_x86_64_pc_windows_msvc",
+)
+
+alias(
+    name = "src_binding_release_aarch64_pc_windows_gnullvm",
+    actual = ":src_binding_release_aarch64_pc_windows_msvc",
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_x86_64_apple_darwin",
+    srcs = [
+        ":v8_146_4_0_x86_64_apple_darwin",
+        ":src_binding_release_x86_64_apple_darwin",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_aarch64_apple_darwin",
+    srcs = [
+        ":v8_146_4_0_aarch64_apple_darwin",
+        ":src_binding_release_aarch64_apple_darwin",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_x86_64_unknown_linux_gnu",
+    srcs = [
+        ":v8_146_4_0_x86_64_unknown_linux_gnu",
+        ":src_binding_release_x86_64_unknown_linux_gnu",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_aarch64_unknown_linux_gnu",
+    srcs = [
+        ":v8_146_4_0_aarch64_unknown_linux_gnu",
+        ":src_binding_release_aarch64_unknown_linux_gnu",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_x86_64_unknown_linux_musl",
+    srcs = [
+        ":v8_146_4_0_x86_64_unknown_linux_musl",
+        ":src_binding_release_x86_64_unknown_linux_musl",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_aarch64_unknown_linux_musl",
+    srcs = [
+        ":v8_146_4_0_aarch64_unknown_linux_musl",
+        ":src_binding_release_aarch64_unknown_linux_musl",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_x86_64_pc_windows_msvc",
+    srcs = [
+        ":v8_146_4_0_x86_64_pc_windows_msvc",
+        ":src_binding_release_x86_64_pc_windows_msvc",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_release_pair_aarch64_pc_windows_msvc",
+    srcs = [
+        ":v8_146_4_0_aarch64_pc_windows_msvc",
+        ":src_binding_release_aarch64_pc_windows_msvc",
+    ],
+)
diff --git a/third_party/v8/README.md b/third_party/v8/README.md
new file mode 100644
index 000000000..3931bbca4
--- /dev/null
+++ b/third_party/v8/README.md
@@ -0,0 +1,45 @@
+# `rusty_v8` Release Artifacts
+
+This directory contains the Bazel packaging used to build and stage
+target-specific `rusty_v8` release artifacts for Bazel-managed consumers.
+
+Current pinned versions:
+
+- Rust crate: `v8 = =146.4.0`
+- Embedded upstream V8 source: `14.6.202.9`
+
+The generated release pairs include:
+
+- `//third_party/v8:rusty_v8_release_pair_x86_64_apple_darwin`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_apple_darwin`
+- `//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_musl`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_unknown_linux_musl`
+- `//third_party/v8:rusty_v8_release_pair_x86_64_pc_windows_msvc`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_pc_windows_msvc`
+
+Each release pair contains:
+
+- a static library built from source
+- a Rust binding file copied from the exact same `v8` crate version for that
+  target
+
+Do not mix artifacts across crate versions. The archive and binding must match
+the exact pinned `v8` crate version used by this repo.
+
+The dedicated publishing workflow is:
+
+- `.github/workflows/rusty-v8-release.yml`
+
+That workflow currently stages musl artifacts:
+
+- `librusty_v8_release_x86_64-unknown-linux-musl.a.gz`
+- `librusty_v8_release_aarch64-unknown-linux-musl.a.gz`
+- `src_binding_release_x86_64-unknown-linux-musl.rs`
+- `src_binding_release_aarch64-unknown-linux-musl.rs`
+
+During musl staging, the produced static archive is merged with the target's
+LLVM `libc++` and `libc++abi` static runtime archives. Rust's musl toolchain
+already provides the matching `libunwind`, so staging does not bundle a second
+copy.
diff --git a/third_party/v8/v8_crate.BUILD.bazel b/third_party/v8/v8_crate.BUILD.bazel
new file mode 100644
index 000000000..f9b2a1998
--- /dev/null
+++ b/third_party/v8/v8_crate.BUILD.bazel
@@ -0,0 +1,41 @@
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "binding_cc",
+    srcs = ["src/binding.cc"],
+)
+
+filegroup(
+    name = "support_h",
+    srcs = ["src/support.h"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_apple_darwin",
+    srcs = ["gen/src_binding_release_aarch64-apple-darwin.rs"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_apple_darwin",
+    srcs = ["gen/src_binding_release_x86_64-apple-darwin.rs"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_unknown_linux_gnu",
+    srcs = ["gen/src_binding_release_aarch64-unknown-linux-gnu.rs"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_unknown_linux_gnu",
+    srcs = ["gen/src_binding_release_x86_64-unknown-linux-gnu.rs"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_pc_windows_msvc",
+    srcs = ["gen/src_binding_release_x86_64-pc-windows-msvc.rs"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_pc_windows_msvc",
+    srcs = ["gen/src_binding_release_aarch64-pc-windows-msvc.rs"],
+)