diff --git a/WORKSPACE b/WORKSPACE
index 1b653100a..837cd0e8d 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -145,10 +145,10 @@ http_archive(
 # Load C++ cross-compilation toolchains.
 http_archive(
     name = "coral_crosstool",
-    sha256 = "088ef98b19a45d7224be13636487e3af57b1564880b67df7be8b3b7eee4a1bfc",
-    strip_prefix = "crosstool-142e930ac6bf1295ff3ba7ba2b5b6324dfb42839",
+    sha256 = "f86d488ca353c5ee99187579fe408adb73e9f2bb1d69c6e3a42ffb904ce3ba01",
+    strip_prefix = "crosstool-8e885509123395299bed6a5f9529fdc1b9751599",
     urls = [
-        "https://github.com/google-coral/crosstool/archive/142e930ac6bf1295ff3ba7ba2b5b6324dfb42839.tar.gz",
+        "https://github.com/google-coral/crosstool/archive/8e885509123395299bed6a5f9529fdc1b9751599.tar.gz",
     ],
 )
 
diff --git a/images/default/Dockerfile b/images/default/Dockerfile
index 9f8d7bc82..a7fcdeaed 100644
--- a/images/default/Dockerfile
+++ b/images/default/Dockerfile
@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y curl gnupg2 git \
         apt-transport-https ca-certificates gnupg-agent \
         software-properties-common \
         pkg-config libffi-dev patch diffutils libssl-dev iptables kmod \
-        clang
+        clang crossbuild-essential-amd64
 
 # Install Docker client for the website build.
 RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
diff --git a/pkg/sentry/platform/systrap/sysmsg/BUILD b/pkg/sentry/platform/systrap/sysmsg/BUILD
index 5c4d31661..569459762 100644
--- a/pkg/sentry/platform/systrap/sysmsg/BUILD
+++ b/pkg/sentry/platform/systrap/sysmsg/BUILD
@@ -1,23 +1,29 @@
-load("//tools:arch.bzl", "select_arch")
+load("//tools:arch.bzl", "arch_genrule", "select_arch")
 load("//tools:defs.bzl", "cc_flags_supplier", "cc_toolchain", "go_library")
 load("build.bzl", "cc_pie_obj")
 
 package(licenses = ["notice"])
 
+cc_flags_supplier(
+    name = "no_pie_cc_flags",
+    features = ["-pie"],
+)
+
 cc_pie_obj(
     name = "sighandler",
     srcs = select_arch(
-        amd64 = ["sighandler_amd64.c"],
-        arm64 = ["sighandler_arm64.c"],
-    ) + [
-        "sysmsg.h",
-        "sysmsg_offsets.h",
-    ],
-    outs = ["sighandler.o"],
-    obj_src = select_arch(
-        amd64 = "sighandler_amd64.c",
-        arm64 = "sighandler_arm64.c",
+        amd64 = [
+            "sighandler_amd64.c",
+            "sysmsg.h",
+            "sysmsg_offsets.h",
+        ],
+        arm64 = [
+            "sighandler_arm64.c",
+            "sysmsg.h",
+            "sysmsg_offsets.h",
+        ],
     ),
+    outs = ["sighandler.o"],
 )
 
 cc_pie_obj(
@@ -28,7 +34,6 @@ cc_pie_obj(
         "sysmsg_offsets.h",
     ],
     outs = ["sysmsg_lib.o"],
-    obj_src = "sysmsg_lib.c",
 )
 
 cc_pie_obj(
@@ -38,29 +43,25 @@ cc_pie_obj(
         arm64 = ["sigrestorer_arm64.S"],
     ),
     outs = ["sysrestorer.o"],
-    obj_src = select_arch(
-        amd64 = "sigrestorer_amd64.S",
-        arm64 = "sigrestorer_arm64.S",
-    ),
 )
 
 cc_pie_obj(
     name = "syshandler",
     srcs = select_arch(
-        amd64 = ["syshandler_amd64.S"],
-        arm64 = ["syshandler_arm64.S"],
-    ) + [
-        "sysmsg_offsets.h",
-    ],
-    outs = ["syshandler.o"],
-    obj_src = select_arch(
-        amd64 = "syshandler_amd64.S",
-        arm64 = "syshandler_arm64.S",
+        amd64 = [
+            "syshandler_amd64.S",
+            "sysmsg_offsets.h",
+        ],
+        arm64 = [
+            "syshandler_arm64.S",
+            "sysmsg_offsets.h",
+        ],
     ),
+    outs = ["syshandler.o"],
 )
 
 genrule(
-    name = "sighandler.built-in.object",
+    name = "sighandler_object",
     srcs = [
         "pie.lds.S",
         ":sighandler",
@@ -70,10 +71,10 @@ genrule(
     ],
     outs = ["sighandler.built-in.bin.o"],
     cmd = "$(LD) " +
-          "-o $(location sighandler.built-in.bin.o) " +
           "-pie -z noexecstack -T $(location pie.lds.S) " +
           "$(location :sysrestorer) $(location :sighandler) " +
-          "$(location :syshandler) $(location :sysmsg_lib) ",
+          "$(location :syshandler) $(location :sysmsg_lib) " +
+          "-o $@",
     features = ["-pie"],
     toolchains = [
         cc_toolchain,
@@ -81,58 +82,53 @@ genrule(
 )
 
 genrule(
-    name = "sighandler.built-in.binary",
-    srcs = [
-        "sighandler.built-in.bin.o",
-        ":sighandler.built-in.object",
-    ],
+    name = "sighandler_binary",
+    srcs = [":sighandler_object"],
     outs = ["sighandler.built-in.bin"],
-    cmd = "$(OBJCOPY)  -O binary " +
-          "$(location :sighandler.built-in.object) $(location sighandler.built-in.bin) ",
+    cmd = "$(OBJCOPY) -O binary $(SRCS) $@",
     toolchains = [
         cc_toolchain,
     ],
 )
 
-genrule(
-    name = "sighandler-golang",
-    srcs = [
-        "sighandler.built-in.bin",
-        "sighandler.built-in.bin.o",
-        ":sighandler.built-in.object",
-    ],
-    outs = ["sighandler.go"],
-    cmd = "bash -x $(location gen_offsets_go.sh) sighandler Sighandler " +
-          "$(location :sighandler.built-in.object) " +
-          "> $(location sighandler.go) ",
-    tools = [
-        "gen_offsets_go.sh",
-    ],
+arch_genrule(
+    name = "sighandler_binary_arch",
+    src = ":sighandler_binary",
+    template = "sighandler.built-in.%s.bin",
 )
 
-cc_flags_supplier(
-    name = "no_pie_cc_flags",
-    features = ["-pie"],
+genrule(
+    name = "sighandler_go",
+    srcs = [":sighandler_object"],
+    outs = ["sighandler.go.arch"],
+    cmd = "bash -x $(location gen_offsets_go.sh) sighandler Sighandler " +
+          "$(SRCS) > $@",
+    tools = ["gen_offsets_go.sh"],
+)
+
+arch_genrule(
+    name = "sighandler_go_arch",
+    src = ":sighandler_go",
+    template = "sighandler_%s.go",
 )
 
 go_library(
     name = "sysmsg",
     srcs = [
-        "sighandler.go",
         "sysmsg.go",
         "sysmsg_amd64.go",
         "sysmsg_arm64.go",
+        ":sighandler_go_arch",
+    ],
+    embedsrcs = [
+        ":sighandler_binary_arch",  # keep
     ],
-    embedsrcs = ["sighandler.built-in.bin"],
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/abi/linux",
         "//pkg/abi/linux/errno",
-        "//pkg/atomicbitops",
         "//pkg/cpuid",
         "//pkg/errors",
         "//pkg/hostarch",
-        "//pkg/sentry/arch",
-        "//pkg/usermem",
     ],
 )
diff --git a/pkg/sentry/platform/systrap/sysmsg/build.bzl b/pkg/sentry/platform/systrap/sysmsg/build.bzl
index 5803668d6..52fbd4e99 100644
--- a/pkg/sentry/platform/systrap/sysmsg/build.bzl
+++ b/pkg/sentry/platform/systrap/sysmsg/build.bzl
@@ -3,7 +3,7 @@
 load("//tools:arch.bzl", "select_arch")
 load("//tools:defs.bzl", "cc_toolchain")
 
-def cc_pie_obj(name, srcs, outs, obj_src):
+def cc_pie_obj(name, srcs, outs):
     native.genrule(
         name = name,
         srcs = srcs,
@@ -25,9 +25,8 @@ def cc_pie_obj(name, srcs, outs, obj_src):
               "-g " +
               "-Wa,--noexecstack " +
               "-fno-asynchronous-unwind-tables " +
-              "-fno-stack-protector -c " +
-              "$(location " + obj_src + ") " +
-              " -o $(location " + outs[0] + ")",
+              "-fno-stack-protector " +
+              "-c $$(echo $(SRCS) | tr ' ' '\n' | grep -v -E '.h$$') -o $@",
         toolchains = [
             ":no_pie_cc_flags",
             cc_toolchain,
diff --git a/pkg/sentry/platform/systrap/sysmsg/sysmsg.go b/pkg/sentry/platform/systrap/sysmsg/sysmsg.go
index a4eecde7e..c69f1d70a 100644
--- a/pkg/sentry/platform/systrap/sysmsg/sysmsg.go
+++ b/pkg/sentry/platform/systrap/sysmsg/sysmsg.go
@@ -21,7 +21,6 @@
 package sysmsg
 
 import (
-	_ "embed"
 	"fmt"
 	"strings"
 	"sync/atomic"
@@ -244,8 +243,3 @@ func (m *Msg) String() string {
 
 	return b.String()
 }
-
-// SighandlerBlob contains the compiled code of the sysmsg signal handler.
-//
-//go:embed sighandler.built-in.bin
-var SighandlerBlob []byte
diff --git a/pkg/sentry/platform/systrap/sysmsg/sysmsg_amd64.go b/pkg/sentry/platform/systrap/sysmsg/sysmsg_amd64.go
index 13283f58b..83f1d617f 100644
--- a/pkg/sentry/platform/systrap/sysmsg/sysmsg_amd64.go
+++ b/pkg/sentry/platform/systrap/sysmsg/sysmsg_amd64.go
@@ -15,12 +15,18 @@
 package sysmsg
 
 import (
+	_ "embed"
 	"fmt"
 	"strings"
 
 	"gvisor.dev/gvisor/pkg/cpuid"
 )
 
+// SighandlerBlob contains the compiled code of the sysmsg signal handler.
+//
+//go:embed sighandler.built-in.amd64.bin
+var SighandlerBlob []byte
+
 // ArchState defines variables specific to the architecture being
 // used.
 type ArchState struct {
diff --git a/pkg/sentry/platform/systrap/sysmsg/sysmsg_arm64.go b/pkg/sentry/platform/systrap/sysmsg/sysmsg_arm64.go
index abbcef5c4..fbae46177 100644
--- a/pkg/sentry/platform/systrap/sysmsg/sysmsg_arm64.go
+++ b/pkg/sentry/platform/systrap/sysmsg/sysmsg_arm64.go
@@ -14,6 +14,15 @@
 
 package sysmsg
 
+import (
+	_ "embed"
+)
+
+// SighandlerBlob contains the compiled code of the sysmsg signal handler.
+//
+//go:embed sighandler.built-in.arm64.bin
+var SighandlerBlob []byte
+
 // ArchState defines variables specific to the architecture being
 // used.
 type ArchState struct{}