diff --git a/.bazelrc.deleted_packages b/.bazelrc.deleted_packages
index da79f11..5654df1 100644
--- a/.bazelrc.deleted_packages
+++ b/.bazelrc.deleted_packages
@@ -54,3 +54,4 @@
 common --deleted_packages=tests/modules/other/simple_v2
 common --deleted_packages=tests/modules/other/with_external_data
 common --deleted_packages=tests/modules/rules_pyrefly_stub/pyrefly
+common --deleted_packages=tests/modules/rules_rust_stub/rust
diff --git a/BUILD.bazel b/BUILD.bazel
index f978126..9013928 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -79,6 +79,7 @@
         "internal_dev_setup.bzl",
         "version.bzl",
         "//command_line_option:distribution",
+        "//crates:distribution",
         "//python:distribution",
         "//tools:distribution",
     ],
diff --git a/MODULE.bazel b/MODULE.bazel
index 53a5674..3ce0c80 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -98,6 +98,20 @@
 bazel_dep(name = "rules_multirun", version = "0.9.0", dev_dependency = True)
 bazel_dep(name = "bazel_ci_rules", version = "1.0.0", dev_dependency = True)
 bazel_dep(name = "rules_pkg", version = "1.2.0", dev_dependency = True)
+bazel_dep(name = "rules_rust", version = "0.73.0", dev_dependency = True)
+
+rust_crates = use_extension(
+    "@rules_rust//crate_universe:extensions.bzl",
+    "crate",
+    dev_dependency = True,
+)
+rust_crates.spec(
+    package = "sha2",
+    version = "0.10.8",
+)
+rust_crates.from_specs()
+use_repo(rust_crates, "crates")
+
 bazel_dep(name = "other", version = "0", dev_dependency = True)
 bazel_dep(name = "another_module", version = "0", dev_dependency = True)
 
diff --git a/crates/BUILD.bazel b/crates/BUILD.bazel
new file mode 100644
index 0000000..d6bf725
--- /dev/null
+++ b/crates/BUILD.bazel
@@ -0,0 +1,10 @@
+package(default_visibility = ["//:__subpackages__"])
+
+licenses(["notice"])
+
+filegroup(
+    name = "distribution",
+    srcs = glob(["**"]) + [
+        "//crates/exe_zip_maker:distribution",
+    ],
+)
diff --git a/crates/exe_zip_maker/BUILD.bazel b/crates/exe_zip_maker/BUILD.bazel
new file mode 100644
index 0000000..94c4783
--- /dev/null
+++ b/crates/exe_zip_maker/BUILD.bazel
@@ -0,0 +1,25 @@
+load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library")
+
+package(default_visibility = ["//:__subpackages__"])
+
+licenses(["notice"])
+
+rust_library(
+    name = "exe_zip_maker_lib",
+    srcs = ["src/lib.rs"],
+    edition = "2021",
+    deps = ["@crates//:sha2"],
+)
+
+rust_binary(
+    name = "exe_zip_maker",
+    srcs = ["src/main.rs"],
+    edition = "2021",
+    visibility = ["//visibility:public"],
+    deps = [":exe_zip_maker_lib"],
+)
+
+filegroup(
+    name = "distribution",
+    srcs = glob(["**"]),
+)
diff --git a/crates/exe_zip_maker/src/lib.rs b/crates/exe_zip_maker/src/lib.rs
new file mode 100644
index 0000000..a7b467e
--- /dev/null
+++ b/crates/exe_zip_maker/src/lib.rs
@@ -0,0 +1,79 @@
+//! Library supporting creating self-executable zip files.
+
+use std::fs::{self, File};
+use std::io::{self, BufReader, BufWriter, Read, Write};
+use std::path::Path;
+
+use sha2::{Digest, Sha256};
+
+pub const BLOCK_SIZE: usize = 256 * 1024;
+pub const PLACEHOLDER: &[u8] = b"%ZIP_HASH%";
+
+/// Replaces all occurrences of `from` with `to` in `src`.
+pub fn replace_bytes(src: &[u8], from: &[u8], to: &[u8]) -> Vec<u8> {
+    if from.is_empty() {
+        return src.to_vec();
+    }
+    let mut result = Vec::new();
+    let mut i = 0;
+    while i < src.len() {
+        if src[i..].starts_with(from) {
+            result.extend_from_slice(to);
+            i += from.len();
+        } else {
+            result.push(src[i]);
+            i += 1;
+        }
+    }
+    result
+}
+
+/// Computes the SHA256 hex digest of the file at `path`.
+pub fn compute_file_sha256_hex(path: &Path) -> io::Result<String> {
+    let mut file = File::open(path)?;
+    let mut hasher = Sha256::new();
+    let mut buffer = [0u8; BLOCK_SIZE];
+    loop {
+        let n = file.read(&mut buffer)?;
+        if n == 0 {
+            break;
+        }
+        hasher.update(&buffer[..n]);
+    }
+    let digest = hasher.finalize();
+    Ok(format!("{:x}", digest))
+}
+
+/// Creates a self-executable zip archive by prepending a preamble to a zip archive
+/// and substituting `%ZIP_HASH%` with the SHA-256 hash of the zip archive.
+pub fn create_exe_zip(preamble_path: &Path, zip_path: &Path, output_path: &Path) -> io::Result<()> {
+    if let Some(parent) = output_path.parent() {
+        if !parent.as_os_str().is_empty() {
+            fs::create_dir_all(parent)?;
+        }
+    }
+
+    let zip_hash = compute_file_sha256_hex(zip_path)?;
+
+    let preamble_content = fs::read(preamble_path)?;
+    let modified_preamble = replace_bytes(&preamble_content, PLACEHOLDER, zip_hash.as_bytes());
+
+    let mut out_file = BufWriter::with_capacity(BLOCK_SIZE, File::create(output_path)?);
+    out_file.write_all(&modified_preamble)?;
+
+    let zip_file = File::open(zip_path)?;
+    let mut zip_reader = BufReader::with_capacity(BLOCK_SIZE, zip_file);
+    io::copy(&mut zip_reader, &mut out_file)?;
+    out_file.flush()?;
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let metadata = fs::metadata(output_path)?;
+        let mut perms = metadata.permissions();
+        perms.set_mode(perms.mode() | 0o111);
+        fs::set_permissions(output_path, perms)?;
+    }
+
+    Ok(())
+}
diff --git a/crates/exe_zip_maker/src/main.rs b/crates/exe_zip_maker/src/main.rs
new file mode 100644
index 0000000..d66fdb2
--- /dev/null
+++ b/crates/exe_zip_maker/src/main.rs
@@ -0,0 +1,24 @@
+use std::env;
+use std::path::Path;
+use std::process;
+
+fn main() {
+    let args: Vec<_> = env::args_os().collect();
+    if args.len() != 4 {
+        let prog_name = args
+            .first()
+            .map(|s| s.to_string_lossy().into_owned())
+            .unwrap_or_else(|| "exe_zip_maker".to_string());
+        eprintln!("Usage: {} <preamble> <zip> <output>", prog_name);
+        process::exit(1);
+    }
+
+    let preamble_path = Path::new(&args[1]);
+    let zip_path = Path::new(&args[2]);
+    let output_path = Path::new(&args[3]);
+
+    if let Err(e) = exe_zip_maker_lib::create_exe_zip(preamble_path, zip_path, output_path) {
+        eprintln!("exe_zip_maker: error: {}", e);
+        process::exit(1);
+    }
+}
diff --git a/internal_dev_deps.bzl b/internal_dev_deps.bzl
index 6d4d765..68b8f89 100644
--- a/internal_dev_deps.bzl
+++ b/internal_dev_deps.bzl
@@ -114,6 +114,13 @@
         path = "tests/modules/rules_pyrefly_stub",
     )
 
+    # Stub repository for rules_rust in WORKSPACE mode so that load()
+    # statements for @rules_rust resolve without requiring full rules_rust.
+    local_repository(
+        name = "rules_rust",
+        path = "tests/modules/rules_rust_stub",
+    )
+
     # The below two deps are required for the integration test with bazel
     # gazelle. Maybe the test should be moved to the `gazelle` workspace?
     http_archive(
diff --git a/tests/exe_zip_maker/BUILD.bazel b/tests/exe_zip_maker/BUILD.bazel
new file mode 100644
index 0000000..4a9190d
--- /dev/null
+++ b/tests/exe_zip_maker/BUILD.bazel
@@ -0,0 +1,14 @@
+load("@rules_rust//rust:defs.bzl", "rust_test")
+
+package(default_visibility = ["//:__subpackages__"])
+
+licenses(["notice"])
+
+rust_test(
+    name = "exe_zip_maker_test",
+    size = "small",
+    srcs = ["exe_zip_maker_test.rs"],
+    deps = [
+        "//crates/exe_zip_maker:exe_zip_maker_lib",
+    ],
+)
diff --git a/tests/exe_zip_maker/exe_zip_maker_test.rs b/tests/exe_zip_maker/exe_zip_maker_test.rs
new file mode 100644
index 0000000..dcd6f94
--- /dev/null
+++ b/tests/exe_zip_maker/exe_zip_maker_test.rs
@@ -0,0 +1,155 @@
+use std::env;
+use std::fs;
+
+use exe_zip_maker_lib::{
+    compute_file_sha256_hex, create_exe_zip, replace_bytes, PLACEHOLDER,
+};
+
+#[test]
+fn test_replace_bytes_none() {
+    let src = b"hello world";
+    assert_eq!(replace_bytes(src, b"foo", b"bar"), b"hello world");
+}
+
+#[test]
+fn test_replace_bytes_single() {
+    let src = b"EXPECTED_HASH='%ZIP_HASH%'";
+    let replaced = replace_bytes(src, PLACEHOLDER, b"12345678");
+    assert_eq!(replaced, b"EXPECTED_HASH='12345678'");
+}
+
+#[test]
+fn test_replace_bytes_multiple() {
+    let src = b"%ZIP_HASH% and %ZIP_HASH%";
+    let replaced = replace_bytes(src, PLACEHOLDER, b"abc");
+    assert_eq!(replaced, b"abc and abc");
+}
+
+#[test]
+fn test_replace_bytes_empty_from() {
+    let src = b"unchanged";
+    assert_eq!(replace_bytes(src, b"", b"abc"), b"unchanged");
+}
+
+#[test]
+fn test_compute_file_sha256_hex() {
+    let temp_dir = env::temp_dir().join(format!("sha256_test_{}", std::process::id()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let file_path = temp_dir.join("sample.txt");
+
+    fs::write(&file_path, b"hello world\n").unwrap();
+    let hash = compute_file_sha256_hex(&file_path).unwrap();
+    assert_eq!(
+        hash,
+        "a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447"
+    );
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[test]
+fn test_create_exe_zip_successful() {
+    let temp_dir = env::temp_dir().join(format!("create_exe_zip_test_{}", std::process::id()));
+    fs::create_dir_all(&temp_dir).unwrap();
+
+    let preamble_path = temp_dir.join("preamble.sh");
+    let zip_path = temp_dir.join("data.zip");
+    let output_path = temp_dir.join("output.exe");
+
+    let zip_content = b"PK\x03\x04dummyzipcontent";
+    fs::write(&zip_path, zip_content).unwrap();
+
+    let preamble_text = b"#!/bin/bash\nEXPECTED_HASH='%ZIP_HASH%'\n# ... logic ...\n";
+    fs::write(&preamble_path, preamble_text).unwrap();
+
+    create_exe_zip(&preamble_path, &zip_path, &output_path).unwrap();
+
+    assert!(output_path.exists());
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let st = fs::metadata(&output_path).unwrap();
+        assert_ne!(
+            st.permissions().mode() & 0o100,
+            0,
+            "Expected executable permission on output file"
+        );
+    }
+
+    let content = fs::read(&output_path).unwrap();
+    let expected_hash = "65e39989ca91c49484998aa3f0429f6943c029609bfd2f3c18c77bf9ded72c59";
+    let expected_preamble = replace_bytes(preamble_text, PLACEHOLDER, expected_hash.as_bytes());
+
+    assert!(content.starts_with(&expected_preamble));
+    assert!(content.ends_with(zip_content));
+    assert_eq!(content.len(), expected_preamble.len() + zip_content.len());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[test]
+fn test_create_exe_zip_multiple_placeholders() {
+    let temp_dir = env::temp_dir().join(format!("create_exe_zip_multi_{}", std::process::id()));
+    fs::create_dir_all(&temp_dir).unwrap();
+
+    let preamble_path = temp_dir.join("preamble.sh");
+    let zip_path = temp_dir.join("data.zip");
+    let output_path = temp_dir.join("output.exe");
+
+    let zip_content = b"PK\x03\x04dummyzipcontent";
+    fs::write(&zip_path, zip_content).unwrap();
+
+    let preamble_text = b"# First: %ZIP_HASH%\n# Second: %ZIP_HASH%\n";
+    fs::write(&preamble_path, preamble_text).unwrap();
+
+    create_exe_zip(&preamble_path, &zip_path, &output_path).unwrap();
+
+    let content = fs::read(&output_path).unwrap();
+    let expected_hash = "65e39989ca91c49484998aa3f0429f6943c029609bfd2f3c18c77bf9ded72c59";
+    let expected_preamble = replace_bytes(preamble_text, PLACEHOLDER, expected_hash.as_bytes());
+
+    assert!(content.starts_with(&expected_preamble));
+    assert!(content.ends_with(zip_content));
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[test]
+fn test_create_exe_zip_creates_parent_dir() {
+    let temp_dir = env::temp_dir().join(format!("create_exe_zip_parent_{}", std::process::id()));
+    fs::create_dir_all(&temp_dir).unwrap();
+
+    let preamble_path = temp_dir.join("preamble.sh");
+    let zip_path = temp_dir.join("data.zip");
+    let output_path = temp_dir.join("nested").join("sub").join("output.exe");
+
+    fs::write(&zip_path, b"content").unwrap();
+    fs::write(&preamble_path, b"preamble").unwrap();
+
+    create_exe_zip(&preamble_path, &zip_path, &output_path).unwrap();
+    assert!(output_path.exists());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[test]
+fn test_create_exe_zip_missing_files() {
+    let temp_dir = env::temp_dir().join(format!("create_exe_zip_err_{}", std::process::id()));
+    fs::create_dir_all(&temp_dir).unwrap();
+
+    let missing_preamble = temp_dir.join("nonexistent_preamble.sh");
+    let zip_path = temp_dir.join("data.zip");
+    let output_path = temp_dir.join("output.exe");
+    fs::write(&zip_path, b"dummy").unwrap();
+
+    assert!(create_exe_zip(&missing_preamble, &zip_path, &output_path).is_err());
+
+    let preamble_path = temp_dir.join("preamble.sh");
+    fs::write(&preamble_path, b"preamble").unwrap();
+    let missing_zip = temp_dir.join("nonexistent_data.zip");
+
+    assert!(create_exe_zip(&preamble_path, &missing_zip, &output_path).is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
diff --git a/tests/modules/rules_rust_stub/WORKSPACE b/tests/modules/rules_rust_stub/WORKSPACE
new file mode 100644
index 0000000..53ff64a
--- /dev/null
+++ b/tests/modules/rules_rust_stub/WORKSPACE
@@ -0,0 +1 @@
+workspace(name = "rules_rust")
diff --git a/tests/modules/rules_rust_stub/rust/BUILD.bazel b/tests/modules/rules_rust_stub/rust/BUILD.bazel
new file mode 100644
index 0000000..0ca983a
--- /dev/null
+++ b/tests/modules/rules_rust_stub/rust/BUILD.bazel
@@ -0,0 +1,3 @@
+package(default_visibility = ["//visibility:public"])
+
+exports_files(["defs.bzl"])
diff --git a/tests/modules/rules_rust_stub/rust/defs.bzl b/tests/modules/rules_rust_stub/rust/defs.bzl
new file mode 100644
index 0000000..b9ca0f3
--- /dev/null
+++ b/tests/modules/rules_rust_stub/rust/defs.bzl
@@ -0,0 +1,40 @@
+"""Stub implementation of rules_rust for WORKSPACE mode."""
+
+# buildifier: disable=unused-variable
+def rust_library(name, **_kwargs):
+    """Stub rust_library rule for WORKSPACE mode.
+
+    Args:
+        name: Target name.
+        **_kwargs: Ignored keyword arguments.
+    """
+    native.filegroup(
+        name = name,
+        tags = ["manual"],
+    )
+
+# buildifier: disable=unused-variable
+def rust_binary(name, **_kwargs):
+    """Stub rust_binary rule for WORKSPACE mode.
+
+    Args:
+        name: Target name.
+        **_kwargs: Ignored keyword arguments.
+    """
+    native.filegroup(
+        name = name,
+        tags = ["manual"],
+    )
+
+# buildifier: disable=unused-variable
+def rust_test(name, **_kwargs):
+    """Stub rust_test rule for WORKSPACE mode.
+
+    Args:
+        name: Target name.
+        **_kwargs: Ignored keyword arguments.
+    """
+    native.filegroup(
+        name = name,
+        tags = ["manual"],
+    )