diff --git a/MODULE.bazel b/MODULE.bazel
index 601e36a5..31d3a40e 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -9,6 +9,7 @@ module(
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_python", version = "1.0.0")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "aspect_bazel_lib", version = "2.21.0")
 
 # Only for development
 bazel_dep(name = "platforms", version = "0.0.10", dev_dependency = True)
diff --git a/WORKSPACE b/WORKSPACE
index aeea9ebd..80a0f619 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -81,3 +81,10 @@ http_archive(
 load("@rules_cc//cc:repositories.bzl", "rules_cc_dependencies")
 
 rules_cc_dependencies()
+
+http_archive(
+    name = "aspect_bazel_lib",
+    sha256 = "6d636cfdecc7f5c1a5d82b9790fb5d5d5e8aa6ea8b53a71a75f1ba53c8d29f61",
+    strip_prefix = "bazel-lib-2.21.0",
+    url = "https://github.com/bazel-contrib/bazel-lib/releases/download/v2.21.0/bazel-lib-v2.21.0.tar.gz",
+)
diff --git a/doc_build/BUILD b/doc_build/BUILD
index 14db111b..e4d093b0 100644
--- a/doc_build/BUILD
+++ b/doc_build/BUILD
@@ -72,6 +72,7 @@ genrule(
         deps = [
             ":rules_pkg_lib",
             "//toolchains/rpm:standard_package",
+            "@aspect_bazel_lib//lib:expand_make_vars",
         ],
     )
     for rule, src in ORDER
diff --git a/pkg/private/tar/tar.bzl b/pkg/private/tar/tar.bzl
index 1d4755af..ea370c48 100644
--- a/pkg/private/tar/tar.bzl
+++ b/pkg/private/tar/tar.bzl
@@ -13,6 +13,7 @@
 # limitations under the License.
 """Rules for making .tar files."""
 
+load("@aspect_bazel_lib//lib:expand_make_vars.bzl", "expand_variables")
 load("//pkg:providers.bzl", "PackageVariablesInfo")
 load(
     "//pkg/private:pkg_files.bzl",
@@ -104,7 +105,8 @@ def _pkg_tar_impl(ctx):
         args.add("--mtime", "portable")
     if ctx.attr.modes:
         for key in ctx.attr.modes:
-            args.add("--modes", "%s=%s" % (_quote(key), ctx.attr.modes[key]))
+            expanded_key = expand_variables(ctx, key)
+            args.add("--modes", "%s=%s" % (_quote(expanded_key), ctx.attr.modes[key]))
     if ctx.attr.owners:
         for key in ctx.attr.owners:
             args.add("--owners", "%s=%s" % (_quote(key), ctx.attr.owners[key]))
@@ -119,8 +121,14 @@ def _pkg_tar_impl(ctx):
 
     # Now we begin processing the files.
     path_mapper = None
+    expanded_remap_paths = {}
     if ctx.attr.remap_paths:
-        path_mapper = lambda path: _remap(ctx.attr.remap_paths, path)
+        for prefix, replacement in ctx.attr.remap_paths.items():
+            expanded_prefix = expand_variables(ctx, prefix)
+            expanded_replacement = expand_variables(ctx, replacement)
+            expanded_remap_paths[expanded_prefix] = expanded_replacement
+
+        path_mapper = lambda path: _remap(expanded_remap_paths, path)
 
     mapping_context = create_mapping_context_from_ctx(
         ctx,
diff --git a/tests/tar/BUILD b/tests/tar/BUILD
index 3164162a..de0b88ef 100644
--- a/tests/tar/BUILD
+++ b/tests/tar/BUILD
@@ -464,6 +464,7 @@ py_test(
         ":test-pkg-tar-from-pkg-files-with-attributes",
         ":test-pkg-tar-with-attributes",
         ":test-remap-paths-tree-artifact",
+        ":test-remap-paths-variables",
         ":test-respect-externally-defined-duplicates.tar",
         ":test-tar-compression_level--1",
         ":test-tar-compression_level-3",
@@ -628,6 +629,16 @@ pkg_tar(
     },
 )
 
+pkg_tar(
+    name = "test-remap-paths-variables",
+    srcs = [
+        ":tree_artifact_to_rename",
+    ],
+    remap_paths = {
+        "/rename_me": "$(COMPILATION_MODE)",
+    },
+)
+
 #
 # Test with symlinks
 #
diff --git a/tests/tar/pkg_tar_test.py b/tests/tar/pkg_tar_test.py
index 245bb797..26738f8a 100644
--- a/tests/tar/pkg_tar_test.py
+++ b/tests/tar/pkg_tar_test.py
@@ -285,6 +285,15 @@ def test_remap_paths_tree_artifact(self):
     ]
     self.assertTarFileContent('test-remap-paths-tree-artifact.tar', content)
 
+  def test_remap_paths_make_variables(self):
+    content = [
+      {'name': 'fastbuild', 'isdir': True},
+      {'name': 'fastbuild/a'},
+      {'name': 'fastbuild/rename_me', 'isdir': True},
+      {'name': 'fastbuild/rename_me/should_not_rename'},
+    ]
+    self.assertTarFileContent('test-remap-paths-variables.tar', content)
+
   def test_externally_defined_duplicate_structure(self):
     content = [
       {'name': './a'},