add misitng test file
diff --git a/pkg/rpm_pfg.bzl b/pkg/rpm_pfg.bzl
index 9b759a0..ff6c8de 100644
--- a/pkg/rpm_pfg.bzl
+++ b/pkg/rpm_pfg.bzl
@@ -515,6 +515,9 @@
     else:
         rpm_name = ctx.attr.name
 
+    version = substitute_package_variables(ctx, ctx.attr.version)
+    architecture = substitute_package_variables(ctx, ctx.attr.architecture)
+
     default_file = ctx.actions.declare_file("{}.rpm".format(rpm_name))
 
     # When stamp is active, don't embed template placeholders in the filename.
@@ -523,8 +526,8 @@
     if not package_file_name:
         package_file_name = _make_rpm_filename(
             rpm_name,
-            ctx.attr.version,
-            ctx.attr.architecture,
+            version,
+            architecture,
             release = effective_release,
         )
 
@@ -542,7 +545,7 @@
         rpm_ctx.make_rpm_args.append("--version=@" + ctx.file.version_file.path)
         files.append(ctx.file.version_file)
     elif ctx.attr.version:
-        preamble_pieces.append("Version: " + ctx.attr.version)
+        preamble_pieces.append("Version: " + version)
     else:
         fail("None of the version or version_file attributes were specified")
 
@@ -585,7 +588,7 @@
         rpm_ctx.make_rpm_args.append("--source_date_epoch=" + str(ctx.attr.source_date_epoch))
 
     if ctx.attr.epoch:
-        preamble_pieces.append("Epoch: " + ctx.attr.epoch)
+        preamble_pieces.append("Epoch: " + substitute_package_variables(ctx, ctx.attr.epoch))
     if ctx.attr.summary:
         preamble_pieces.append("Summary: " + ctx.attr.summary)
     if ctx.attr.url:
@@ -619,7 +622,7 @@
     # In the meantime, this will allow the "architecture" attribute to take
     # effect.
     if ctx.attr.architecture:
-        preamble_pieces.append("BuildArch: " + ctx.attr.architecture)
+        preamble_pieces.append("BuildArch: " + architecture)
 
     if ctx.attr.debuginfo:
         # RedHat distros have redhat-rpm-config with %_enable_debug_packages macro; others need explicit declaration
diff --git a/tests/deb/pkg_deb_variables_test.py b/tests/deb/pkg_deb_variables_test.py
new file mode 100644
index 0000000..71c551f
--- /dev/null
+++ b/tests/deb/pkg_deb_variables_test.py
@@ -0,0 +1,96 @@
+# Copyright 2024 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# -*- coding: utf-8 -*-
+"""Tests that package_variables substitution works in pkg_deb string attributes."""
+
+import codecs
+from io import BytesIO
+import tarfile
+import unittest
+
+from python.runfiles import runfiles
+from pkg.private import archive
+
+
+class DebInspect(object):
+    """Class to open and unpack a .deb file so we can examine it."""
+
+    def __init__(self, deb_file):
+        self.deb_version = None
+        self.data = None
+        self.control = None
+        with archive.SimpleArReader(deb_file) as f:
+            info = f.next()
+            while info:
+                if info.filename == 'debian-binary':
+                    self.deb_version = info.data
+                elif info.filename == 'control.tar.gz':
+                    self.control = info.data
+                elif info.filename == 'data.tar.gz':
+                    self.data = info.data
+                else:
+                    raise Exception('Unexpected file: %s' % info.filename)
+                info = f.next()
+
+    def get_deb_ctl_file(self, file_name):
+        """Extract a control file."""
+        with tarfile.open(mode='r:gz', fileobj=BytesIO(self.control)) as f:
+            for info in f:
+                if info.name == './' + file_name:
+                    return codecs.decode(f.extractfile(info).read(), 'utf-8')
+        raise Exception('Could not find control file: %s' % file_name)
+
+
+class PkgDebVariablesTest(unittest.TestCase):
+    """Tests that package_variables substitution is applied to pkg_deb string attributes."""
+
+    def setUp(self):
+        super(PkgDebVariablesTest, self).setUp()
+        self.runfiles = runfiles.Create()
+        # my_package_variables provides label="some_value", so:
+        #   package = "pkg-$(label)" -> "pkg-some_value"
+        #   architecture = "$(label)" -> "some_value"
+        deb_path = self.runfiles.Rlocation(
+            'rules_pkg/tests/deb/pkg-some_value_1.0_some_value.deb')
+        self.deb_file = DebInspect(deb_path)
+
+    def test_control_fields_have_substituted_values(self):
+        control = self.deb_file.get_deb_ctl_file('control')
+        # Variables from my_package_variables: label="some_value"
+        fields_expected = [
+            'Package: pkg-some_value',
+            'Architecture: some_value',
+            'Depends: dep-some_value',
+        ]
+        for field in fields_expected:
+            self.assertIn(
+                field, control,
+                'Missing or unsubstituted control field: <%s> in <%s>' % (field, control))
+
+    def test_description_has_substituted_value(self):
+        control = self.deb_file.get_deb_ctl_file('control')
+        self.assertIn(
+            'Description: Description for some_value',
+            control,
+            'Description field does not have substituted value in <%s>' % control)
+        # Confirm the raw variable syntax is NOT present
+        self.assertNotIn(
+            '$(label)',
+            control,
+            'Raw variable syntax still present in control: <%s>' % control)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/rpm/analysis_tests.bzl b/tests/rpm/analysis_tests.bzl
index fd3317f..25462ca 100644
--- a/tests/rpm/analysis_tests.bzl
+++ b/tests/rpm/analysis_tests.bzl
@@ -288,6 +288,43 @@
     )
 
     ##################################################
+    # With pkg_variables expanding version/architecture
+    ##################################################
+
+    pkg_files(
+        name = "{}_varsubst_file_base".format(name),
+        srcs = ["foo"],
+        tags = ["manual"],
+    )
+
+    pkg_filegroup(
+        name = "{}_varsubst_pfg".format(name),
+        srcs = [":{}_varsubst_file_base".format(name)],
+        tags = ["manual"],
+    )
+
+    pkg_rpm(
+        name = name + "_varsubst_rpm",
+        srcs = [":{}_varsubst_pfg".format(name)],
+        architecture = "$(BAR)",
+        description = "Description for $(FOO)",
+        license = "N/A",
+        package_variables = ":{}_pkg_variables".format(name),
+        release = "1",
+        summary = "A test",
+        tags = ["manual"],
+        version = "$(FOO)",
+    )
+
+    # Verify that version="$(FOO)"→"foo" and architecture="$(BAR)"→"bar"
+    # are reflected in the output filename (NVR.A format: name-version-release.arch.rpm).
+    package_naming_test(
+        name = name + "_varsubst",
+        target_under_test = ":" + name + "_varsubst_rpm",
+        expected_name = name + "_varsubst_rpm-foo-1.bar.rpm",
+    )
+
+    ##################################################
     # Test suite declaration
     ##################################################
 
@@ -297,6 +334,7 @@
             ":{}_{}".format(name, test_name)
             for test_name in [
                 "no_extra",
+                "varsubst",
                 "with_different_name",
             ]
         ],