diff --git a/cc/toolchains/gcc_arm_embedded/BUILD.bazel b/cc/toolchains/gcc_arm_embedded/BUILD.bazel
index 49039fd..dd30d43 100644
--- a/cc/toolchains/gcc_arm_embedded/BUILD.bazel
+++ b/cc/toolchains/gcc_arm_embedded/BUILD.bazel
@@ -115,6 +115,10 @@ config(
             "//conditions:default": [],
         },
     ),
+    sysroot = select({
+        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav++swift_cc_toolchain_extension+gcc_arm_embedded_toolchain",
+        "//conditions:default": "external/gcc_arm_embedded_toolchain",
+    }),
 )
 
 cc_toolchain(
diff --git a/cc/toolchains/gcc_arm_embedded/config.bzl b/cc/toolchains/gcc_arm_embedded/config.bzl
index f2cf9cb..1d87402 100644
--- a/cc/toolchains/gcc_arm_embedded/config.bzl
+++ b/cc/toolchains/gcc_arm_embedded/config.bzl
@@ -80,7 +80,7 @@ def _impl(ctx):
                     flag_groups = ([
                         flag_group(
                             flags = [
-                                "--sysroot=external/gcc_arm_embedded_toolchain",
+                                "--sysroot={}".format(ctx.attr.sysroot),
                                 "-no-canonical-prefixes",
                                 "-fno-canonical-system-headers",
                                 "-fno-common",
@@ -167,6 +167,7 @@ config = rule(
     attrs = {
         "c_opts": attr.string_list(),
         "link_opts": attr.string_list(),
+        "sysroot": attr.string(),
     },
     provides = [CcToolchainConfigInfo],
 )
diff --git a/cc/toolchains/llvm/aarch64-linux/wrappers/wrapper b/cc/toolchains/llvm/aarch64-linux/wrappers/wrapper
index 7046a5b..e4e312e 100755
--- a/cc/toolchains/llvm/aarch64-linux/wrappers/wrapper
+++ b/cc/toolchains/llvm/aarch64-linux/wrappers/wrapper
@@ -35,7 +35,7 @@ fi
 
 tool_name=$(basename "${BASH_SOURCE[0]}")
 toolchain_bindir=external/aarch64-linux-llvm/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~aarch64-linux-llvm/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+aarch64-linux-llvm/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/llvm20/aarch64-darwin/wrappers/wrapper b/cc/toolchains/llvm20/aarch64-darwin/wrappers/wrapper
index d782849..f0eddf7 100755
--- a/cc/toolchains/llvm20/aarch64-darwin/wrappers/wrapper
+++ b/cc/toolchains/llvm20/aarch64-darwin/wrappers/wrapper
@@ -37,7 +37,7 @@ tool_name=$(basename "${BASH_SOURCE[0]}")
 # In case the tool label is changed, a change in here is very likely needed
 # This establishes backwards compatibility with the old WORKSPACE file
 toolchain_bindir=external/aarch64-darwin-llvm20/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~aarch64-darwin-llvm20/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+aarch64-darwin-llvm20/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/llvm20/aarch64-linux/wrappers/wrapper b/cc/toolchains/llvm20/aarch64-linux/wrappers/wrapper
index 7005306..f7c73fd 100755
--- a/cc/toolchains/llvm20/aarch64-linux/wrappers/wrapper
+++ b/cc/toolchains/llvm20/aarch64-linux/wrappers/wrapper
@@ -37,7 +37,7 @@ tool_name=$(basename "${BASH_SOURCE[0]}")
 # In case the tool label is changed, a change in here is very likely needed
 # This establishes backwards compatibility with the old WORKSPACE file
 toolchain_bindir=external/aarch64-linux-llvm20/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~aarch64-linux-llvm20/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+aarch64-linux-llvm20/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/llvm20/x86_64-aarch64-linux/BUILD.bazel b/cc/toolchains/llvm20/x86_64-aarch64-linux/BUILD.bazel
index 0ff5f7f..db7734c 100644
--- a/cc/toolchains/llvm20/x86_64-aarch64-linux/BUILD.bazel
+++ b/cc/toolchains/llvm20/x86_64-aarch64-linux/BUILD.bazel
@@ -103,7 +103,7 @@ cc_toolchain_config(
     abi_version = "clang",
     builtin_sysroot = select({
         # Remove once bzlmod is enabled by default
-        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav~~swift_cc_toolchain_extension~aarch64-sysroot",
+        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav++swift_cc_toolchain_extension+aarch64-sysroot",
         "//conditions:default": "external/aarch64-sysroot",
     }),
     compiler = "clang",
diff --git a/cc/toolchains/llvm20/x86_64-aarch64-linux/wrappers/wrapper b/cc/toolchains/llvm20/x86_64-aarch64-linux/wrappers/wrapper
index e7b7ed6..c4b474a 100755
--- a/cc/toolchains/llvm20/x86_64-aarch64-linux/wrappers/wrapper
+++ b/cc/toolchains/llvm20/x86_64-aarch64-linux/wrappers/wrapper
@@ -37,7 +37,7 @@ tool_name=$(basename "${BASH_SOURCE[0]}")
 # In case the tool label is changed, a change in here is very likely needed
 # This establishes backwards compatibility with the old WORKSPACE file
 toolchain_bindir=external/x86_64-linux-llvm20/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~x86_64-linux-llvm20/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+x86_64-linux-llvm20/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/llvm20/x86_64-darwin/wrappers/wrapper b/cc/toolchains/llvm20/x86_64-darwin/wrappers/wrapper
index 830dd11..0a0a845 100755
--- a/cc/toolchains/llvm20/x86_64-darwin/wrappers/wrapper
+++ b/cc/toolchains/llvm20/x86_64-darwin/wrappers/wrapper
@@ -37,7 +37,7 @@ tool_name=$(basename "${BASH_SOURCE[0]}")
 # In case the tool label is changed, a change in here is very likely needed
 # This establishes backwards compatibility with the old WORKSPACE file
 toolchain_bindir=external/x86_64-darwin-llvm20/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~x86_64-darwin-llvm20/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+x86_64-darwin-llvm20/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/llvm20/x86_64-linux/BUILD.bazel b/cc/toolchains/llvm20/x86_64-linux/BUILD.bazel
index 75706ce..75f47b5 100644
--- a/cc/toolchains/llvm20/x86_64-linux/BUILD.bazel
+++ b/cc/toolchains/llvm20/x86_64-linux/BUILD.bazel
@@ -118,7 +118,7 @@ cc_toolchain_config(
     builtin_sysroot = select({
         "@rules_swiftnav//cc:_use_libcpp": None,
         # Remove once bzlmod is enabled by default
-        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav~~swift_cc_toolchain_extension~x86_64-sysroot",
+        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav++swift_cc_toolchain_extension+x86_64-sysroot",
         "//conditions:default": "external/x86_64-sysroot",
     }),
     compiler = "clang",
diff --git a/cc/toolchains/llvm20/x86_64-linux/wrappers/wrapper b/cc/toolchains/llvm20/x86_64-linux/wrappers/wrapper
index d815675..09504ac 100755
--- a/cc/toolchains/llvm20/x86_64-linux/wrappers/wrapper
+++ b/cc/toolchains/llvm20/x86_64-linux/wrappers/wrapper
@@ -37,7 +37,7 @@ tool_name=$(basename "${BASH_SOURCE[0]}")
 # In case the tool label is changed, a change in here is very likely needed
 # This establishes backwards compatibility with the old WORKSPACE file
 toolchain_bindir=external/x86_64-linux-llvm20/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~x86_64-linux-llvm20/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+x86_64-linux-llvm20/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/musl/aarch64/BUILD.bazel b/cc/toolchains/musl/aarch64/BUILD.bazel
index 7506e32..2394f03 100644
--- a/cc/toolchains/musl/aarch64/BUILD.bazel
+++ b/cc/toolchains/musl/aarch64/BUILD.bazel
@@ -77,7 +77,13 @@ filegroup(
     tags = ["manual"],
 )
 
-config(name = "config")
+config(
+    name = "config",
+    sysroot = select({
+        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav++swift_cc_toolchain_extension+aarch64-linux-musl",
+        "//conditions:default": "external/aarch64-linux-musl",
+    }),
+)
 
 cc_toolchain(
     name = "cc_toolchain",
diff --git a/cc/toolchains/musl/aarch64/config.bzl b/cc/toolchains/musl/aarch64/config.bzl
index 4444bef..66a14af 100644
--- a/cc/toolchains/musl/aarch64/config.bzl
+++ b/cc/toolchains/musl/aarch64/config.bzl
@@ -80,7 +80,7 @@ def _impl(ctx):
                     flag_groups = ([
                         flag_group(
                             flags = [
-                                "--sysroot=external/aarch64-linux-musl",
+                                "--sysroot={}".format(ctx.attr.sysroot),
                                 "-no-canonical-prefixes",
                                 "-fno-canonical-system-headers",
                                 "-fno-common",
@@ -120,7 +120,7 @@ def _impl(ctx):
                     flag_groups = ([
                         flag_group(
                             flags = [
-                                "--sysroot=external/aarch64-linux-musl",
+                                "--sysroot={}".format(ctx.attr.sysroot),
                                 "-Wl,-O1",
                                 "-Wl,--hash-style=gnu",
                                 "-Wl,--as-needed",
@@ -152,6 +152,8 @@ def _impl(ctx):
 
 config = rule(
     implementation = _impl,
-    attrs = {},
+    attrs = {
+        "sysroot": attr.string(),
+    },
     provides = [CcToolchainConfigInfo],
 )
diff --git a/cc/toolchains/musl/aarch64/wrappers/wrapper b/cc/toolchains/musl/aarch64/wrappers/wrapper
index d87cae4..ce8141a 100755
--- a/cc/toolchains/musl/aarch64/wrappers/wrapper
+++ b/cc/toolchains/musl/aarch64/wrappers/wrapper
@@ -35,7 +35,7 @@ fi
 
 tool_name=$(basename "${BASH_SOURCE[0]}")
 toolchain_bindir=external/aarch64-linux-musl/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~aarch64-linux-musl/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+aarch64-linux-musl/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/musl/armhf/BUILD.bazel b/cc/toolchains/musl/armhf/BUILD.bazel
index ac0b01e..be6bb70 100644
--- a/cc/toolchains/musl/armhf/BUILD.bazel
+++ b/cc/toolchains/musl/armhf/BUILD.bazel
@@ -77,7 +77,13 @@ filegroup(
     tags = ["manual"],
 )
 
-config(name = "config")
+config(
+    name = "config",
+    sysroot = select({
+        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav++swift_cc_toolchain_extension+arm-linux-musleabihf",
+        "//conditions:default": "external/arm-linux-musleabihf",
+    }),
+)
 
 cc_toolchain(
     name = "cc_toolchain",
diff --git a/cc/toolchains/musl/armhf/config.bzl b/cc/toolchains/musl/armhf/config.bzl
index 77dd18b..c17a830 100644
--- a/cc/toolchains/musl/armhf/config.bzl
+++ b/cc/toolchains/musl/armhf/config.bzl
@@ -80,7 +80,7 @@ def _impl(ctx):
                     flag_groups = ([
                         flag_group(
                             flags = [
-                                "--sysroot=external/arm-linux-musleabihf",
+                                "--sysroot={}".format(ctx.attr.sysroot),
                                 "-no-canonical-prefixes",
                                 "-fno-canonical-system-headers",
                                 "-fno-common",
@@ -120,7 +120,7 @@ def _impl(ctx):
                     flag_groups = ([
                         flag_group(
                             flags = [
-                                "--sysroot=external/arm-linux-musleabihf",
+                                "--sysroot={}".format(ctx.attr.sysroot),
                                 "-Wl,-O1",
                                 "-Wl,--hash-style=gnu",
                                 "-Wl,--as-needed",
@@ -152,6 +152,8 @@ def _impl(ctx):
 
 config = rule(
     implementation = _impl,
-    attrs = {},
+    attrs = {
+        "sysroot": attr.string(),
+    },
     provides = [CcToolchainConfigInfo],
 )
diff --git a/cc/toolchains/musl/armhf/wrappers/wrapper b/cc/toolchains/musl/armhf/wrappers/wrapper
index da1148d..7805342 100755
--- a/cc/toolchains/musl/armhf/wrappers/wrapper
+++ b/cc/toolchains/musl/armhf/wrappers/wrapper
@@ -35,7 +35,7 @@ fi
 
 tool_name=$(basename "${BASH_SOURCE[0]}")
 toolchain_bindir=external/arm-linux-musleabihf/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~arm-linux-musleabihf/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+arm-linux-musleabihf/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.
diff --git a/cc/toolchains/musl/x86_64/BUILD.bazel b/cc/toolchains/musl/x86_64/BUILD.bazel
index fd6ff10..d42e5f5 100644
--- a/cc/toolchains/musl/x86_64/BUILD.bazel
+++ b/cc/toolchains/musl/x86_64/BUILD.bazel
@@ -77,7 +77,13 @@ filegroup(
     tags = ["manual"],
 )
 
-config(name = "config")
+config(
+    name = "config",
+    sysroot = select({
+        "@rules_swiftnav//cc:_enable_bzlmod": "external/rules_swiftnav++swift_cc_toolchain_extension+x86_64-linux-musl",
+        "//conditions:default": "external/x86_64-linux-musl",
+    }),
+)
 
 cc_toolchain(
     name = "cc_toolchain",
diff --git a/cc/toolchains/musl/x86_64/config.bzl b/cc/toolchains/musl/x86_64/config.bzl
index 16386d5..c7b4581 100644
--- a/cc/toolchains/musl/x86_64/config.bzl
+++ b/cc/toolchains/musl/x86_64/config.bzl
@@ -80,7 +80,7 @@ def _impl(ctx):
                     flag_groups = ([
                         flag_group(
                             flags = [
-                                "--sysroot=external/x86_64-linux-musl",
+                                "--sysroot={}".format(ctx.attr.sysroot),
                                 "-no-canonical-prefixes",
                                 "-fno-canonical-system-headers",
                                 "-fno-common",
@@ -120,7 +120,7 @@ def _impl(ctx):
                     flag_groups = ([
                         flag_group(
                             flags = [
-                                "--sysroot=external/x86_64-linux-musl",
+                                "--sysroot={}".format(ctx.attr.sysroot),
                                 "-Wl,-O1",
                                 "-Wl,--hash-style=gnu",
                                 "-Wl,--as-needed",
@@ -152,6 +152,8 @@ def _impl(ctx):
 
 config = rule(
     implementation = _impl,
-    attrs = {},
+    attrs = {
+        "sysroot": attr.string(),
+    },
     provides = [CcToolchainConfigInfo],
 )
diff --git a/cc/toolchains/musl/x86_64/wrappers/wrapper b/cc/toolchains/musl/x86_64/wrappers/wrapper
index b0a51d7..39138bc 100755
--- a/cc/toolchains/musl/x86_64/wrappers/wrapper
+++ b/cc/toolchains/musl/x86_64/wrappers/wrapper
@@ -35,7 +35,7 @@ fi
 
 tool_name=$(basename "${BASH_SOURCE[0]}")
 toolchain_bindir=external/x86_64-linux-musl/bin
-toolchain_bindir_as_bzlmod="external/rules_swiftnav~~swift_cc_toolchain_extension~x86_64-linux-musl/bin"
+toolchain_bindir_as_bzlmod="external/rules_swiftnav++swift_cc_toolchain_extension+x86_64-linux-musl/bin"
 
 if [[ -f "${toolchain_bindir}"/"${tool_name}" ]]; then
   # We're running under _execroot_, call the real tool.