diff --git a/.bazelrc b/.bazelrc
index e34a363a16fc..98478f4d9965 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -5,6 +5,9 @@ common --lockfile_mode=off
 # Build release binaries by default, can be overwritten to in local.bazelrc and set to `fastbuild` or `dbg`
 build --compilation_mode opt
 
+# Preserve CodeQL's placeholder during rules_pkg variable substitution.
+build --define=CODEQL_PLATFORM={CODEQL_PLATFORM}
+
 # when building from this repository in isolation, the internal repository will not be found at ..
 # where `MODULE.bazel` looks for it. The following will get us past the module loading phase, so
 # that we can build things that do not rely on that
diff --git a/.bazelrc.internal b/.bazelrc.internal
index 245cd98fbd84..3872da2192a8 100644
--- a/.bazelrc.internal
+++ b/.bazelrc.internal
@@ -1,5 +1,8 @@
 # this file should contain bazel settings required to build things from `semmle-code`
 
+# Preserve CodeQL's placeholder during rules_pkg variable substitution.
+build --define=CODEQL_PLATFORM={CODEQL_PLATFORM}
+
 common --registry=file:///%workspace%/ql/misc/bazel/registry
 common --registry=https://bcr.bazel.build
 
diff --git a/MODULE.bazel b/MODULE.bazel
index 9ebcf569f563..94098f3b7b58 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -18,7 +18,7 @@ bazel_dep(name = "platforms", version = "1.1.0")
 bazel_dep(name = "rules_cc", version = "0.2.27")
 bazel_dep(name = "rules_go", version = "0.65.0")
 bazel_dep(name = "rules_java", version = "9.9.0")
-bazel_dep(name = "rules_pkg", version = "1.2.0")
+bazel_dep(name = "rules_pkg", version = "1.3.0")
 bazel_dep(name = "rules_nodejs", version = "6.7.7")
 bazel_dep(name = "rules_python", version = "2.4.6")
 bazel_dep(name = "rules_shell", version = "0.8.0")
diff --git a/swift/extractor/BUILD.bazel b/swift/extractor/BUILD.bazel
index 425d72146527..ee8010a20295 100644
--- a/swift/extractor/BUILD.bazel
+++ b/swift/extractor/BUILD.bazel
@@ -1,5 +1,5 @@
 load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
-load("//misc/bazel:pkg.bzl", "codeql_pkg_files", "codeql_pkg_runfiles")
+load("//misc/bazel:pkg.bzl", "codeql_pkg_files", "codeql_pkg_files_overlay", "codeql_pkg_runfiles")
 load("//swift:rules.bzl", "swift_cc_binary")
 
 swift_cc_binary(
@@ -31,9 +31,23 @@ sh_binary(
 )
 
 codeql_pkg_runfiles(
-    name = "pkg",
+    name = "extractor-files",
     excludes = ["extractor.sh"],  # script gets copied as "extractor", no need for the original .sh file
     exes = [":extractor"],
+)
+
+codeql_pkg_files(
+    name = "shared-libraries",
+    exes = ["//swift/third_party/resources:shared-libraries"],
+)
+
+# Use original libraries: _solib artifacts can have owners that do not match their runfiles repository.
+codeql_pkg_files_overlay(
+    name = "pkg",
+    srcs = [
+        ":extractor-files",
+        ":shared-libraries",
+    ],
     visibility = ["//swift:__pkg__"],
 )
 
diff --git a/swift/third_party/BUILD.swift-llvm-support.bazel b/swift/third_party/BUILD.swift-llvm-support.bazel
index 6390ca31718a..28b32b170b9f 100644
--- a/swift/third_party/BUILD.swift-llvm-support.bazel
+++ b/swift/third_party/BUILD.swift-llvm-support.bazel
@@ -15,13 +15,14 @@ cc_library(
         "include",
         "stdlib/public/SwiftShims",
     ],
+    visibility = ["//visibility:public"],
     deps = [
         "@zstd",
     ],
 )
 
-cc_library(
-    name = "swift-llvm-support",
+filegroup(
+    name = "swift-llvm-support-shared",
     srcs = glob(
         [
             "*.so",
@@ -29,21 +30,5 @@ cc_library(
         ],
         allow_empty = True,  # Either *.so or *.dylib will be empty
     ),
-    linkopts = [
-        "-lm",
-        "-lz",
-    ] + select({
-        "@platforms//os:linux": [
-            "-luuid",
-            "-lrt",
-            "-lpthread",
-            "-ldl",
-        ],
-        "@platforms//os:macos": [
-            "-L/usr/lib/swift",
-        ],
-        "//conditions:default": [],
-    }),
     visibility = ["//visibility:public"],
-    deps = [":swift-llvm-support-static"],
 )
diff --git a/swift/third_party/resources/BUILD.bazel b/swift/third_party/resources/BUILD.bazel
index 0ceca995b94f..2111a7cd7944 100644
--- a/swift/third_party/resources/BUILD.bazel
+++ b/swift/third_party/resources/BUILD.bazel
@@ -1,4 +1,6 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
+load("//misc/bazel:os.bzl", "os_select")
 
 _oses = ("linux", "macos")
 
@@ -13,13 +15,39 @@ alias(
 )
 
 alias(
+    name = "shared-libraries",
+    actual = select({"@platforms//os:" + os: "@swift-prebuilt-%s//:swift-llvm-support-shared" % os for os in _oses}),
+    target_compatible_with = select({
+        "@platforms//os:windows": ["@platforms//:incompatible"],
+        "//conditions:default": [],
+    }),
+    visibility = ["//swift/extractor:__pkg__"],
+)
+
+cc_library(
     name = "prebuilt",
-    actual = select({"@platforms//os:" + os: "@swift-prebuilt-%s//:swift-llvm-support" % os for os in _oses}),
+    srcs = [":shared-libraries"],
+    linkopts = [
+        "-lm",
+        "-lz",
+    ] + os_select(
+        default = [],
+        linux = [
+            "-luuid",
+            "-lrt",
+            "-lpthread",
+            "-ldl",
+        ],
+        macos = [
+            "-L/usr/lib/swift",
+        ],
+    ),
     target_compatible_with = select({
         "@platforms//os:windows": ["@platforms//:incompatible"],
         "//conditions:default": [],
     }),
     visibility = ["//visibility:public"],
+    deps = select({"@platforms//os:" + os: ["@swift-prebuilt-%s//:swift-llvm-support-static" % os] for os in _oses}),
 )
 
 [