diff --git a/crates/openshell-core/src/proto/mod.rs b/crates/openshell-core/src/proto/mod.rs
index 4a9e117153..7a0f87c837 100644
--- a/crates/openshell-core/src/proto/mod.rs
+++ b/crates/openshell-core/src/proto/mod.rs
@@ -46,16 +46,20 @@ pub mod compute {
     pub use super::generated::openshell::compute::v1;
 }
 
+#[allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    dead_code,
+    unused_imports,
+    unused_qualifications,
+    rust_2018_idioms
+)]
 pub mod credentials {
-    #[allow(
-        clippy::all,
-        clippy::pedantic,
-        clippy::nursery,
-        dead_code,
-        unused_imports,
-        unused_qualifications,
-        rust_2018_idioms
-    )]
+    #[cfg(bazel)]
+    pub use super::generated::openshell::credentials::v1;
+
+    #[cfg(not(bazel))]
     pub mod v1 {
         include!(concat!(env!("OUT_DIR"), "/openshell.credentials.v1.rs"));
     }
diff --git a/crates/openshell-driver-db-credstore/BUILD.bazel b/crates/openshell-driver-db-credstore/BUILD.bazel
new file mode 100644
index 0000000000..ec5e01f7fd
--- /dev/null
+++ b/crates/openshell-driver-db-credstore/BUILD.bazel
@@ -0,0 +1,27 @@
+load("@crates//:defs.bzl", "aliases", "all_crate_deps")
+load("@rules_rs//rs:rust_library.bzl", "rust_library")
+load("@rules_rs//rs:rust_test.bzl", "rust_test")
+load("@rules_rust//rust:defs.bzl", "rustfmt_test")
+
+rust_library(
+    name = "openshell-driver-db-credstore",
+    srcs = glob(["src/**/*.rs"]),
+    aliases = aliases(),
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True),
+)
+
+rust_test(
+    name = "openshell-driver-db-credstore_test",
+    crate = ":openshell-driver-db-credstore",
+    deps = all_crate_deps(normal_dev = True),
+)
+
+rustfmt_test(
+    name = "rustfmt_test",
+    targets = [
+        ":openshell-driver-db-credstore",
+        ":openshell-driver-db-credstore_test",
+    ],
+    visibility = ["//crates:__pkg__"],
+)
diff --git a/crates/openshell-driver-kubernetes-secrets/BUILD.bazel b/crates/openshell-driver-kubernetes-secrets/BUILD.bazel
new file mode 100644
index 0000000000..383932b556
--- /dev/null
+++ b/crates/openshell-driver-kubernetes-secrets/BUILD.bazel
@@ -0,0 +1,41 @@
+load("@crates//:defs.bzl", "aliases", "all_crate_deps")
+load("@rules_rs//rs:rust_binary.bzl", "rust_binary")
+load("@rules_rs//rs:rust_library.bzl", "rust_library")
+load("@rules_rs//rs:rust_test.bzl", "rust_test")
+load("@rules_rust//rust:defs.bzl", "rustfmt_test")
+
+rust_library(
+    name = "openshell-driver-kubernetes-secrets",
+    srcs = glob(
+        ["src/**/*.rs"],
+        exclude = ["src/main.rs"],
+    ),
+    aliases = aliases(),
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True),
+)
+
+rust_binary(
+    name = "openshell-driver-kubernetes-secrets_bin",
+    srcs = ["src/main.rs"],
+    aliases = aliases(),
+    binary_name = "openshell-driver-kubernetes-secrets",
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True) + [":openshell-driver-kubernetes-secrets"],
+)
+
+rust_test(
+    name = "openshell-driver-kubernetes-secrets_test",
+    crate = ":openshell-driver-kubernetes-secrets",
+    deps = all_crate_deps(normal_dev = True),
+)
+
+rustfmt_test(
+    name = "rustfmt_test",
+    targets = [
+        ":openshell-driver-kubernetes-secrets",
+        ":openshell-driver-kubernetes-secrets_bin",
+        ":openshell-driver-kubernetes-secrets_test",
+    ],
+    visibility = ["//crates:__pkg__"],
+)
diff --git a/crates/openshell-driver-vault/BUILD.bazel b/crates/openshell-driver-vault/BUILD.bazel
new file mode 100644
index 0000000000..3743e911b2
--- /dev/null
+++ b/crates/openshell-driver-vault/BUILD.bazel
@@ -0,0 +1,41 @@
+load("@crates//:defs.bzl", "aliases", "all_crate_deps")
+load("@rules_rs//rs:rust_binary.bzl", "rust_binary")
+load("@rules_rs//rs:rust_library.bzl", "rust_library")
+load("@rules_rs//rs:rust_test.bzl", "rust_test")
+load("@rules_rust//rust:defs.bzl", "rustfmt_test")
+
+rust_library(
+    name = "openshell-driver-vault",
+    srcs = glob(
+        ["src/**/*.rs"],
+        exclude = ["src/main.rs"],
+    ),
+    aliases = aliases(),
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True),
+)
+
+rust_binary(
+    name = "openshell-driver-vault_bin",
+    srcs = ["src/main.rs"],
+    aliases = aliases(),
+    binary_name = "openshell-driver-vault",
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True) + [":openshell-driver-vault"],
+)
+
+rust_test(
+    name = "openshell-driver-vault_test",
+    crate = ":openshell-driver-vault",
+    deps = all_crate_deps(normal_dev = True),
+)
+
+rustfmt_test(
+    name = "rustfmt_test",
+    targets = [
+        ":openshell-driver-vault",
+        ":openshell-driver-vault_bin",
+        ":openshell-driver-vault_test",
+    ],
+    visibility = ["//crates:__pkg__"],
+)
diff --git a/crates/openshell-sandbox/BUILD.bazel b/crates/openshell-sandbox/BUILD.bazel
index 3b4c74b96e..dac448831a 100644
--- a/crates/openshell-sandbox/BUILD.bazel
+++ b/crates/openshell-sandbox/BUILD.bazel
@@ -12,7 +12,10 @@ rust_library(
         exclude = ["src/main.rs"],
     ),
     aliases = aliases(),
-    crate_features = ["telemetry"],
+    crate_features = [
+        "bundled-ca-roots",
+        "telemetry",
+    ],
     version = WORKSPACE_VERSION,
     visibility = ["//visibility:public"],
     deps = all_crate_deps(normal = True),
@@ -33,7 +36,10 @@ rust_test(
     name = "openshell-sandbox_lib_test",
     compile_data = ["//crates/openshell-supervisor-network:sandbox-policy-rego"],
     crate = ":openshell-sandbox",
-    crate_features = ["telemetry"],
+    crate_features = [
+        "bundled-ca-roots",
+        "telemetry",
+    ],
     deps = all_crate_deps(normal_dev = True),
 )
 
diff --git a/crates/openshell-supervisor-network/BUILD.bazel b/crates/openshell-supervisor-network/BUILD.bazel
index fe3673a6ba..851b719585 100644
--- a/crates/openshell-supervisor-network/BUILD.bazel
+++ b/crates/openshell-supervisor-network/BUILD.bazel
@@ -14,6 +14,7 @@ rust_library(
     srcs = glob(["src/**/*.rs"]),
     aliases = aliases(),
     compile_data = glob(["data/**/*"]),
+    crate_features = ["bundled-ca-roots"],
     visibility = ["//visibility:public"],
     deps = all_crate_deps(normal = True),
 )
@@ -22,6 +23,7 @@ rust_test(
     name = "openshell-supervisor-network_test",
     compile_data = glob(["testdata/**/*"]),
     crate = ":openshell-supervisor-network",
+    crate_features = ["bundled-ca-roots"],
     deps = all_crate_deps(normal_dev = True),
 )