diff --git a/runsc/BUILD b/runsc/BUILD
index f85e6d3b8..a79241cb5 100644
--- a/runsc/BUILD
+++ b/runsc/BUILD
@@ -9,15 +9,17 @@ go_binary(
     name = "runsc",
     srcs = [
         "main.go",
-        "version.go",
     ],
     pure = True,
     tags = ["staging"],
     visibility = [
         "//visibility:public",
     ],
-    x_defs = {"main.version": "{STABLE_VERSION}"},
-    deps = ["//runsc/cli"],
+    x_defs = {"gvisor.dev/gvisor/runsc/version.version": "{STABLE_VERSION}"},
+    deps = [
+        "//runsc/cli",
+        "//runsc/version",
+    ],
 )
 
 # The runsc-race target is a race-compatible BUILD target. This must be built
@@ -37,15 +39,17 @@ go_binary(
     name = "runsc-race",
     srcs = [
         "main.go",
-        "version.go",
     ],
     gotags = ["lockdep"],
     static = True,
     visibility = [
         "//visibility:public",
     ],
-    x_defs = {"main.version": "{STABLE_VERSION}"},
-    deps = ["//runsc/cli"],
+    x_defs = {"gvisor.dev/gvisor/runsc/version.version": "{STABLE_VERSION}"},
+    deps = [
+        "//runsc/cli",
+        "//runsc/version",
+    ],
 )
 
 sh_test(
diff --git a/runsc/cli/BUILD b/runsc/cli/BUILD
index f4c8bb1a2..625a0aab0 100644
--- a/runsc/cli/BUILD
+++ b/runsc/cli/BUILD
@@ -24,6 +24,7 @@ go_library(
         "//runsc/config",
         "//runsc/flag",
         "//runsc/specutils",
+        "//runsc/version",
         "@com_github_google_subcommands//:go_default_library",
         "@org_golang_x_sys//unix:go_default_library",
     ],
diff --git a/runsc/cli/main.go b/runsc/cli/main.go
index 6518a9da2..f554e849d 100644
--- a/runsc/cli/main.go
+++ b/runsc/cli/main.go
@@ -38,6 +38,7 @@ import (
 	"gvisor.dev/gvisor/runsc/config"
 	"gvisor.dev/gvisor/runsc/flag"
 	"gvisor.dev/gvisor/runsc/specutils"
+	"gvisor.dev/gvisor/runsc/version"
 )
 
 var (
@@ -56,7 +57,7 @@ var (
 )
 
 // Main is the main entrypoint.
-func Main(version string) {
+func Main() {
 	// Help and flags commands are generated automatically.
 	help := cmd.NewHelp(subcommands.DefaultCommander)
 	help.Register(new(cmd.Platforms))
@@ -118,7 +119,7 @@ func Main(version string) {
 	// Are we showing the version?
 	if *showVersion {
 		// The format here is the same as runc.
-		fmt.Fprintf(os.Stdout, "runsc version %s\n", version)
+		fmt.Fprintf(os.Stdout, "runsc version %s\n", version.Version())
 		fmt.Fprintf(os.Stdout, "spec: %s\n", specutils.Version)
 		os.Exit(0)
 	}
@@ -221,7 +222,7 @@ func Main(version string) {
 
 	log.Infof("***************************")
 	log.Infof("Args: %s", os.Args)
-	log.Infof("Version %s", version)
+	log.Infof("Version %s", version.Version())
 	log.Infof("GOOS: %s", runtime.GOOS)
 	log.Infof("GOARCH: %s", runtime.GOARCH)
 	log.Infof("PID: %d", os.Getpid())
diff --git a/runsc/main.go b/runsc/main.go
index 4ce5ebee9..1f89dd187 100644
--- a/runsc/main.go
+++ b/runsc/main.go
@@ -17,8 +17,13 @@ package main
 
 import (
 	"gvisor.dev/gvisor/runsc/cli"
+	"gvisor.dev/gvisor/runsc/version"
 )
 
+// version.Version is set dynamically, but needs to be
+// linked in the binary, so reference it here.
+var _ = version.Version()
+
 func main() {
-	cli.Main(version)
+	cli.Main()
 }
diff --git a/runsc/version/BUILD b/runsc/version/BUILD
new file mode 100644
index 000000000..f3c9c0559
--- /dev/null
+++ b/runsc/version/BUILD
@@ -0,0 +1,12 @@
+load("//tools:defs.bzl", "go_library")
+
+package(
+    default_applicable_licenses = ["//:license"],
+    licenses = ["notice"],
+)
+
+go_library(
+    name = "version",
+    srcs = ["version.go"],
+    visibility = ["//:sandbox"],
+)
diff --git a/runsc/version.go b/runsc/version/version.go
similarity index 61%
rename from runsc/version.go
rename to runsc/version/version.go
index c250f4a2a..16b3da3ff 100644
--- a/runsc/version.go
+++ b/runsc/version/version.go
@@ -1,4 +1,4 @@
-// Copyright 2019 The gVisor Authors.
+// Copyright 2023 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -15,7 +15,16 @@
 //go:build go1.1
 // +build go1.1
 
-package main
+// Package version holds a string containing version information for runsc.
+// Other packages may import it to get this information while avoiding
+// import loops.
+package version
 
-// version is set during linking.
+// version is the version string.
+// It is initialized by the runsc main() function.
 var version = "VERSION_MISSING"
+
+// Version returns the version string.
+func Version() string {
+	return version
+}
diff --git a/runsc/version_test.sh b/runsc/version_test.sh
index 747350654..510b40a4f 100755
--- a/runsc/version_test.sh
+++ b/runsc/version_test.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 The gVisor Authors.
+# Copyright 2023 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -19,8 +19,8 @@ set -euf -x -o pipefail
 readonly runsc="$1"
 readonly version=$($runsc --version)
 
-# Version should should not match VERSION, which is the default and which will
-# also appear if something is wrong with workspace_status.sh script.
+# Version should should not match VERSION, which is the default and which
+# will also appear if something is wrong with workspace_status.sh script.
 if [[ $version =~ "VERSION" ]]; then
   echo "FAIL: Got bad version $version"
   exit 1