diff --git a/site/en/external/extension.md b/site/en/external/extension.md
index e0374f8b4bd175..5ba774961105ba 100644
--- a/site/en/external/extension.md
+++ b/site/en/external/extension.md
@@ -165,6 +165,14 @@ several repo visibility rules:
         the apparent name `foo`, and the extension generates a repo with the
         specified name `foo`, then for all repos generated by that extension
         `foo` refers to the former.
+*   Similarly, in a module extension's implementation function, repos created
+    by the extension can refer to each other by their apparent names in
+    attributes, regardless of the order in which they are created.
+    *   In case of a conflict with a repository visible to the module, labels
+        passed to repository rule attributes can be wrapped in a call to
+        [`Label`](/rules/lib/toplevel/attr#label) to ensure that they refer to
+        the repo visible to the module instead of the extension-generated repo
+        of the same name.
 
 ## Best practices
 
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/AttributeValues.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/AttributeValues.java
index 3cdbce47252caf..f78f4636e8abf1 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/AttributeValues.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/AttributeValues.java
@@ -45,14 +45,15 @@ public static AttributeValues create(Map<String, Object> attribs) {
 
   public abstract Dict<String, Object> attributes();
 
-  public static void validateAttrs(AttributeValues attributes, String what) throws EvalException {
+  public static void validateAttrs(
+      AttributeValues attributes, String where, String what) throws EvalException {
     for (var entry : attributes.attributes().entrySet()) {
-      validateSingleAttr(entry.getKey(), entry.getValue(), what);
+      validateSingleAttr(entry.getKey(), entry.getValue(), where, what);
     }
   }
 
-  public static void validateSingleAttr(String attrName, Object attrValue, String what)
-      throws EvalException {
+  public static void validateSingleAttr(
+      String attrName, Object attrValue, String where, String what) throws EvalException {
     var maybeNonVisibleLabel = getFirstNonVisibleLabel(attrValue);
     if (maybeNonVisibleLabel.isEmpty()) {
       return;
@@ -60,17 +61,9 @@ public static void validateSingleAttr(String attrName, Object attrValue, String
     Label label = maybeNonVisibleLabel.get();
     String repoName = label.getRepository().getName();
     throw Starlark.errorf(
-        "no repository visible as '@%s' to the %s, but referenced by label '@%s//%s:%s' in"
-            + " attribute '%s' of %s. Is the %s missing a bazel_dep or use_repo(..., \"%s\")?",
-        repoName,
-        label.getRepository().getOwnerRepoDisplayString(),
-        repoName,
-        label.getPackageName(),
-        label.getName(),
-        attrName,
-        what,
-        label.getRepository().getOwnerModuleDisplayString(),
-        repoName);
+        "no repository visible as '@%s' %s, but referenced by label '@%s//%s:%s' in"
+            + " attribute '%s' of %s.",
+        repoName, where, repoName, label.getPackageName(), label.getName(), attrName, what);
   }
 
   private static Optional<Label> getFirstNonVisibleLabel(Object nativeAttrValue) {
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionEvalStarlarkThreadContext.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionEvalStarlarkThreadContext.java
index 685ad2fbd53db3..5524c1168b3cd0 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionEvalStarlarkThreadContext.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionEvalStarlarkThreadContext.java
@@ -15,10 +15,11 @@
 
 package com.google.devtools.build.lib.bazel.bzlmod;
 
-import com.google.auto.value.AutoValue;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Maps;
 import com.google.devtools.build.lib.analysis.BlazeDirectories;
+import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.cmdline.PackageIdentifier;
 import com.google.devtools.build.lib.cmdline.RepositoryMapping;
 import com.google.devtools.build.lib.cmdline.RepositoryName;
@@ -29,12 +30,16 @@
 import com.google.devtools.build.lib.packages.RuleClass;
 import com.google.devtools.build.lib.packages.RuleFactory.InvalidRuleException;
 import com.google.devtools.build.lib.packages.StarlarkNativeModule.ExistingRulesShouldBeNoOp;
-import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.Map;
 import javax.annotation.Nullable;
 import net.starlark.java.eval.Dict;
 import net.starlark.java.eval.EvalException;
+import net.starlark.java.eval.NoneType;
 import net.starlark.java.eval.Starlark;
+import net.starlark.java.eval.StarlarkInt;
+import net.starlark.java.eval.StarlarkList;
+import net.starlark.java.eval.StarlarkSemantics;
 import net.starlark.java.eval.StarlarkThread;
 import net.starlark.java.syntax.Location;
 
@@ -56,94 +61,162 @@ public static ModuleExtensionEvalStarlarkThreadContext fromOrNull(StarlarkThread
     return ctx instanceof ModuleExtensionEvalStarlarkThreadContext c ? c : null;
   }
 
-  @AutoValue
-  abstract static class RepoSpecAndLocation {
-    abstract RepoSpec getRepoSpec();
-
-    abstract Location getLocation();
-
-    static RepoSpecAndLocation create(RepoSpec repoSpec, Location location) {
-      return new AutoValue_ModuleExtensionEvalStarlarkThreadContext_RepoSpecAndLocation(
-          repoSpec, location);
-    }
-  }
+  record RepoRuleCall(
+      RuleClass ruleClass,
+      Dict<String, Object> kwargs,
+      Location location,
+      ImmutableList<StarlarkThread.CallStackEntry> callStack) {}
 
+  private final ModuleExtensionId extensionId;
   private final String repoPrefix;
   private final PackageIdentifier basePackageId;
-  private final RepositoryMapping repoMapping;
+  private final RepositoryMapping baseRepoMapping;
   private final BlazeDirectories directories;
   private final ExtendedEventHandler eventHandler;
-  private final Map<String, RepoSpecAndLocation> generatedRepos = new HashMap<>();
+  private final Map<String, RepoRuleCall> deferredRepos = new LinkedHashMap<>();
 
   public ModuleExtensionEvalStarlarkThreadContext(
+      ModuleExtensionId extensionId,
       String repoPrefix,
       PackageIdentifier basePackageId,
-      RepositoryMapping repoMapping,
+      RepositoryMapping baseRepoMapping,
       RepositoryMapping mainRepoMapping,
       BlazeDirectories directories,
       ExtendedEventHandler eventHandler) {
     super(() -> mainRepoMapping);
+    this.extensionId = extensionId;
     this.repoPrefix = repoPrefix;
     this.basePackageId = basePackageId;
-    this.repoMapping = repoMapping;
+    this.baseRepoMapping = baseRepoMapping;
     this.directories = directories;
     this.eventHandler = eventHandler;
   }
 
-  public void createRepo(StarlarkThread thread, Dict<String, Object> kwargs, RuleClass ruleClass)
-      throws InterruptedException, EvalException {
+  /**
+   * Records a call to a repo rule that should be created at the end of the module extension
+   * evaluation.
+   */
+  public void lazilyCreateRepo(
+      StarlarkThread thread, Dict<String, Object> kwargs, RuleClass ruleClass)
+      throws EvalException {
     Object nameValue = kwargs.getOrDefault("name", Starlark.NONE);
     if (!(nameValue instanceof String name)) {
       throw Starlark.errorf(
           "expected string for attribute 'name', got '%s'", Starlark.type(nameValue));
     }
     RepositoryName.validateUserProvidedRepoName(name);
-    RepoSpecAndLocation conflict = generatedRepos.get(name);
+    RepoRuleCall conflict = deferredRepos.get(name);
     if (conflict != null) {
       throw Starlark.errorf(
           "A repo named %s is already generated by this module extension at %s",
-          name, conflict.getLocation());
+          name, conflict.location());
     }
-    String prefixedName = repoPrefix + name;
-    try {
-      Rule rule =
-          BzlmodRepoRuleCreator.createRule(
-              basePackageId,
-              repoMapping,
-              directories,
-              thread.getSemantics(),
-              eventHandler,
-              thread.getCallStack(),
-              ruleClass,
-              Maps.transformEntries(kwargs, (k, v) -> k.equals("name") ? prefixedName : v));
+    deferredRepos.put(
+        name,
+        new RepoRuleCall(
+            ruleClass,
+            // The extension may mutate the values of the kwargs after this function returns.
+            (Dict<String, Object>) deepCloneAttrValue(kwargs),
+            thread.getCallerLocation(),
+            thread.getCallStack()));
+  }
 
-      Map<String, Object> attributes =
-          Maps.filterKeys(
-              Maps.transformEntries(kwargs, (k, v) -> rule.getAttr(k)), k -> !k.equals("name"));
-      String bzlFile = ruleClass.getRuleDefinitionEnvironmentLabel().getUnambiguousCanonicalForm();
-      var attributesValue = AttributeValues.create(attributes);
-      AttributeValues.validateAttrs(
-          attributesValue, String.format("%s '%s'", rule.getRuleClass(), name));
-      RepoSpec repoSpec =
-          RepoSpec.builder()
-              .setBzlFile(bzlFile)
-              .setRuleClassName(ruleClass.getName())
-              .setAttributes(attributesValue)
-              .build();
+  /**
+   * Evaluates the repo rule calls recorded by {@link #lazilyCreateRepo} and returns all repos
+   * generated by the extension. The key is the "internal name" (as specified by the extension) of
+   * the repo, and the value is the {@link RepoSpec}.
+   */
+  public ImmutableMap<String, RepoSpec> createRepos(StarlarkSemantics starlarkSemantics)
+      throws EvalException, InterruptedException {
+    // LINT.IfChange
+    // Make it possible to refer to extension repos in the label attributes of another extension
+    // repo. Wrapping a label in Label(...) ensures that it is evaluated with respect to the
+    // containing module's repo mapping instead.
+    var extensionRepos =
+        Maps.asMap(
+            deferredRepos.keySet(),
+            apparentName -> RepositoryName.createUnvalidated(repoPrefix + apparentName));
+    RepositoryMapping fullRepoMapping =
+        RepositoryMapping.create(extensionRepos, baseRepoMapping.ownerRepo())
+            .withAdditionalMappings(baseRepoMapping);
+    // LINT.ThenChange(//src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionRepoMappingEntriesFunction.java)
+
+    ImmutableMap.Builder<String, RepoSpec> repoSpecs = ImmutableMap.builder();
+    for (var entry : deferredRepos.entrySet()) {
+      String name = entry.getKey();
+      RepoRuleCall repoRuleCall = entry.getValue();
+      try {
+        String prefixedName = repoPrefix + name;
+        Rule rule =
+            BzlmodRepoRuleCreator.createRule(
+                basePackageId,
+                fullRepoMapping,
+                directories,
+                starlarkSemantics,
+                eventHandler,
+                repoRuleCall.callStack,
+                repoRuleCall.ruleClass,
+                Maps.transformEntries(
+                    repoRuleCall.kwargs, (k, v) -> k.equals("name") ? prefixedName : v));
 
-      generatedRepos.put(name, RepoSpecAndLocation.create(repoSpec, thread.getCallerLocation()));
-    } catch (InvalidRuleException | NoSuchPackageException e) {
-      throw Starlark.errorf("%s", e.getMessage());
+        Map<String, Object> attributes =
+            Maps.filterKeys(
+                Maps.transformEntries(repoRuleCall.kwargs, (k, v) -> rule.getAttr(k)),
+                k -> !k.equals("name"));
+        String bzlFile =
+            repoRuleCall
+                .ruleClass
+                .getRuleDefinitionEnvironmentLabel()
+                .getUnambiguousCanonicalForm();
+        var attributesValue = AttributeValues.create(attributes);
+        AttributeValues.validateAttrs(
+            attributesValue,
+            String.format("in the extension '%s'", extensionId.asTargetString()),
+            String.format("%s '%s'", rule.getRuleClass(), name));
+        RepoSpec repoSpec =
+            RepoSpec.builder()
+                .setBzlFile(bzlFile)
+                .setRuleClassName(repoRuleCall.ruleClass.getName())
+                .setAttributes(attributesValue)
+                .build();
+        repoSpecs.put(name, repoSpec);
+      } catch (EvalException e) {
+        throw e.withCallStack(repoRuleCall.callStack);
+      } catch (InvalidRuleException | NoSuchPackageException e) {
+        throw new EvalException(e).withCallStack(repoRuleCall.callStack);
+      }
     }
+    return repoSpecs.buildOrThrow();
   }
 
   /**
-   * Returns the repos generated by the extension so far. The key is the "internal name" (as
-   * specified by the extension) of the repo, and the value is the package containing (only) the
-   * repo rule.
+   * Deep-clones a potentially mutable Starlark object that is a valid repo rule attribute.
+   * Immutable (sub-)objects are not cloned.
    */
-  public ImmutableMap<String, RepoSpec> getGeneratedRepoSpecs() {
-    return ImmutableMap.copyOf(
-        Maps.transformValues(generatedRepos, RepoSpecAndLocation::getRepoSpec));
+  private static Object deepCloneAttrValue(Object x) throws EvalException {
+    if (x instanceof NoneType
+        || x instanceof Boolean
+        || x instanceof StarlarkInt
+        || x instanceof String
+        || x instanceof Label) {
+      return x;
+    }
+    // Mutable Starlark values have to be cloned deeply.
+    if (x instanceof Dict<?, ?> dict) {
+      Dict.Builder<Object, Object> newDict = Dict.builder();
+      for (Map.Entry<?, ?> e : dict.entrySet()) {
+        newDict.put(deepCloneAttrValue(e.getKey()), deepCloneAttrValue(e.getValue()));
+      }
+      return newDict.buildImmutable();
+    }
+    if (x instanceof Iterable<?> iterable) {
+      ImmutableList.Builder<Object> newList = ImmutableList.builder();
+      for (Object item : iterable) {
+        newList.add(deepCloneAttrValue(item));
+      }
+      return StarlarkList.immutableCopyOf(newList.build());
+    }
+    throw Starlark.errorf(
+        "unexpected Starlark value: %s (of type %s)", Starlark.repr(x), Starlark.type(x));
   }
 }
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionRepoMappingEntriesFunction.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionRepoMappingEntriesFunction.java
index f128ae882df9e2..9253d38813ea04 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionRepoMappingEntriesFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionRepoMappingEntriesFunction.java
@@ -70,9 +70,11 @@ private ModuleExtensionRepoMappingEntriesValue computeRepoMappingEntries(
     // extension generates an internal repo name "bar", then within a repo generated by the
     // extension, "bar" will refer to the latter. We should explore a way to differentiate between
     // the two to avoid any surprises.
+    // LINT.IfChange
     ImmutableMap.Builder<String, RepositoryName> entries = ImmutableMap.builder();
     entries.putAll(bazelDepGraphValue.getFullRepoMapping(moduleKey).entries());
     entries.putAll(extensionEvalValue.getCanonicalRepoNameToInternalNames().inverse());
     return ModuleExtensionRepoMappingEntriesValue.create(entries.buildKeepingLast(), moduleKey);
+    // LINT.ThenChange(//src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionEvalStarlarkThreadContext.java)
   }
 }
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java
index 9cff3b3b12bb7d..77173e27108636 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java
@@ -202,7 +202,7 @@ public SkyValue compute(SkyKey skyKey, Environment env)
     try {
       module = moduleThreadContext.buildModule(getModuleFileResult.registry);
     } catch (EvalException e) {
-      env.getListener().handle(Event.error(e.getMessageWithStack()));
+      env.getListener().handle(Event.error(e.getInnermostLocation(), e.getMessageWithStack()));
       throw errorf(Code.BAD_MODULE, "error executing MODULE.bazel file for %s", moduleKey);
     }
     if (!module.getName().equals(moduleKey.getName())) {
@@ -482,10 +482,7 @@ public static RootModuleFileValue evaluateRootModuleFile(
                     .map(label -> Label.parseCanonicalUnchecked(label).toPathFragment()))
             .collect(toImmutableSet());
     return RootModuleFileValue.create(
-        module,
-        overrides,
-        nonRegistryOverrideCanonicalRepoNameLookup,
-        moduleFilePaths);
+        module, overrides, nonRegistryOverrideCanonicalRepoNameLookup, moduleFilePaths);
   }
 
   private static ModuleThreadContext execModuleFile(
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleKey.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleKey.java
index 681d9e3faae983..5c17301722b378 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleKey.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleKey.java
@@ -73,6 +73,14 @@ public final String toString() {
     return getName() + "@" + (getVersion().isEmpty() ? "_" : getVersion().toString());
   }
 
+  /** Returns a string such as "root module" or "module foo@1.2.3" for display purposes. */
+  public final String toDisplayString() {
+    if (this.equals(ROOT)) {
+      return "root module";
+    }
+    return String.format("module '%s'", this);
+  }
+
   /**
    * Returns the canonical name of the repo backing this module, including its version. This name is
    * always guaranteed to be unique.
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/SingleExtensionEvalFunction.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/SingleExtensionEvalFunction.java
index d632c4e779e1b6..3e4aef19f0a6d5 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/SingleExtensionEvalFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/SingleExtensionEvalFunction.java
@@ -484,7 +484,7 @@ private SingleExtensionValue createSingleExtensionValue(
                     generatedRepoSpecs.keySet(),
                     env.getListener());
       } catch (EvalException e) {
-        env.getListener().handle(Event.error(e.getMessageWithStack()));
+        env.getListener().handle(Event.error(e.getInnermostLocation(), e.getMessageWithStack()));
         throw new SingleExtensionEvalFunctionException(
             ExternalDepsException.withMessage(
                 Code.BAD_MODULE,
@@ -569,7 +569,7 @@ RunModuleExtensionResult run(
         SingleExtensionUsagesValue usagesValue,
         StarlarkSemantics starlarkSemantics,
         ModuleExtensionId extensionId,
-        RepositoryMapping repositoryMapping)
+        RepositoryMapping mainRepositoryMapping)
         throws InterruptedException, SingleExtensionEvalFunctionException;
   }
 
@@ -786,7 +786,9 @@ public RunModuleExtensionResult run(
                       Maps.transformEntries(kwargs, (k, v) -> ruleInstance.getAttr(k)),
                       k -> !k.equals("name")));
           AttributeValues.validateAttrs(
-              attributesValue, String.format("%s '%s'", ruleInstance.getRuleClass(), name));
+              attributesValue,
+              String.format("to the %s", moduleKey.toDisplayString()),
+              String.format("%s '%s'", ruleInstance.getRuleClass(), name));
         } catch (InvalidRuleException | NoSuchPackageException | EvalException e) {
           throw new SingleExtensionEvalFunctionException(
               ExternalDepsException.withCauseAndMessage(
@@ -907,6 +909,7 @@ public RunModuleExtensionResult run(
         throws InterruptedException, SingleExtensionEvalFunctionException {
       ModuleExtensionEvalStarlarkThreadContext threadContext =
           new ModuleExtensionEvalStarlarkThreadContext(
+              extensionId,
               usagesValue.getExtensionUniqueName() + "+",
               extensionId.getBzlFileLabel().getPackageIdentifier(),
               BazelModuleContext.of(bzlLoadValue.getModule()).repoMapping(),
@@ -967,11 +970,11 @@ public RunModuleExtensionResult run(
             moduleContext.getRecordedFileInputs(),
             moduleContext.getRecordedDirentsInputs(),
             moduleContext.getRecordedEnvVarInputs(),
-            threadContext.getGeneratedRepoSpecs(),
+            threadContext.createRepos(starlarkSemantics),
             moduleExtensionMetadata,
             repoMappingRecorder.recordedEntries());
       } catch (EvalException e) {
-        env.getListener().handle(Event.error(e.getMessageWithStack()));
+        env.getListener().handle(Event.error(e.getInnermostLocation(), e.getMessageWithStack()));
         throw new SingleExtensionEvalFunctionException(
             ExternalDepsException.withMessage(
                 ExternalDeps.Code.BAD_MODULE,
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/StarlarkBazelModule.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/StarlarkBazelModule.java
index f15f7d4e22f8c2..30969644e54d1b 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/StarlarkBazelModule.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/StarlarkBazelModule.java
@@ -135,7 +135,9 @@ public static StarlarkBazelModule create(
       // (for example, String to Label).
       typeCheckedTags
           .get(tag.getTagName())
-          .add(TypeCheckedTag.create(tagClass, tag, labelConverter));
+          .add(
+              TypeCheckedTag.create(
+                  tagClass, tag, labelConverter, module.getKey().toDisplayString()));
     }
     return new StarlarkBazelModule(
         module.getName(),
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTag.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTag.java
index 33c27acad20d1a..0b0ecd3a7db928 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTag.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTag.java
@@ -57,7 +57,8 @@ private TypeCheckedTag(
   }
 
   /** Creates a {@link TypeCheckedTag}. */
-  public static TypeCheckedTag create(TagClass tagClass, Tag tag, LabelConverter labelConverter)
+  public static TypeCheckedTag create(
+      TagClass tagClass, Tag tag, LabelConverter labelConverter, String moduleDisplayString)
       throws ExternalDepsException {
     Object[] attrValues = new Object[tagClass.getAttributes().size()];
     for (Map.Entry<String, Object> attrValue : tag.getAttributeValues().attributes().entrySet()) {
@@ -113,7 +114,10 @@ public static TypeCheckedTag create(TagClass tagClass, Tag tag, LabelConverter l
       }
       try {
         AttributeValues.validateSingleAttr(
-            attr.getPublicName(), attrValues[i], String.format("tag '%s'", tag.getTagName()));
+            attr.getPublicName(),
+            attrValues[i],
+            String.format("to the %s", moduleDisplayString),
+            String.format("tag '%s'", tag.getTagName()));
       } catch (EvalException e) {
         throw ExternalDepsException.withMessage(
             Code.BAD_MODULE, "in tag at %s: %s", tag.getLocation(), e.getMessage());
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryFunction.java b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryFunction.java
index 5c13901ee1d1d0..0340faddb0824b 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryFunction.java
@@ -353,6 +353,7 @@ private RepositoryDirectoryValue.Builder fetchInternal(
       env.getListener()
           .handle(
               Event.error(
+                  e.getInnermostLocation(),
                   "An error occurred during the fetch of repository '"
                       + rule.getName()
                       + "':\n   "
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryModule.java b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryModule.java
index db2605c91eb7bf..a8e3571eebce5c 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryModule.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryModule.java
@@ -222,7 +222,7 @@ public Object call(StarlarkThread thread, Tuple args, Dict<String, Object> kwarg
       if (!isExported()) {
         throw new EvalException("attempting to instantiate a non-exported repository rule");
       }
-      extensionEvalContext.createRepo(thread, kwargs, getRuleClass());
+      extensionEvalContext.lazilyCreateRepo(thread, kwargs, getRuleClass());
       return Starlark.NONE;
     }
 
diff --git a/src/main/java/com/google/devtools/build/lib/rules/repository/ResolvedFileFunction.java b/src/main/java/com/google/devtools/build/lib/rules/repository/ResolvedFileFunction.java
index 78bd833c910a35..5e81081a1792d4 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/repository/ResolvedFileFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/repository/ResolvedFileFunction.java
@@ -100,7 +100,8 @@ public SkyValue compute(SkyKey skyKey, Environment env)
                   SymbolGenerator.create(skyKey));
           Starlark.execFileProgram(prog, module, thread);
         } catch (EvalException ex) {
-          env.getListener().handle(Event.error(null, ex.getMessageWithStack()));
+          env.getListener()
+              .handle(Event.error(ex.getInnermostLocation(), ex.getMessageWithStack()));
           throw resolvedValueError("Failed to evaluate resolved file " + key.getPath());
         }
         Object resolved = module.getGlobal("resolved");
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/BuildTopLevelAspectsDetailsFunction.java b/src/main/java/com/google/devtools/build/lib/skyframe/BuildTopLevelAspectsDetailsFunction.java
index 59ada981d16844..ba6a57e6d96126 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/BuildTopLevelAspectsDetailsFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/BuildTopLevelAspectsDetailsFunction.java
@@ -131,7 +131,7 @@ private static ImmutableList<Aspect> getTopLevelAspects(
         try {
           builder.addAspect(starlarkAspect);
         } catch (EvalException e) {
-          env.getListener().handle(Event.error(e.getMessage()));
+          env.getListener().handle(Event.error(e.getInnermostLocation(), e.getMessageWithStack()));
           throw new BuildTopLevelAspectsDetailsFunctionException(
               new TopLevelAspectsDetailsBuildFailedException(
                   e.getMessage(), Code.ASPECT_CREATION_FAILED));
@@ -153,7 +153,7 @@ private static ImmutableList<Aspect> getTopLevelAspects(
         aspectsList.validateTopLevelAspectsParameters(topLevelAspectsParameters);
         return aspectsList.buildAspects(topLevelAspectsParameters);
     } catch (EvalException e) {
-      env.getListener().handle(Event.error(e.getMessage()));
+      env.getListener().handle(Event.error(e.getInnermostLocation(), e.getMessageWithStack()));
       throw new BuildTopLevelAspectsDetailsFunctionException(
           new TopLevelAspectsDetailsBuildFailedException(
               e.getMessage(), Code.ASPECT_CREATION_FAILED));
diff --git a/src/main/java/net/starlark/java/eval/EvalException.java b/src/main/java/net/starlark/java/eval/EvalException.java
index 3529db8daed912..a777379f9b1642 100644
--- a/src/main/java/net/starlark/java/eval/EvalException.java
+++ b/src/main/java/net/starlark/java/eval/EvalException.java
@@ -37,9 +37,9 @@ public class EvalException extends Exception {
   // built-in function has no stack until it is thrown out of a function call.
   @Nullable private ImmutableList<StarlarkThread.CallStackEntry> callstack;
 
-  /** Constructs an EvalException. Use {@link Starlak#errorf} if you want string formatting. */
+  /** Constructs an EvalException. Use {@link Starlark#errorf} if you want string formatting. */
   public EvalException(String message) {
-    this(message, /*cause=*/ null);
+    this(message, /* cause= */ (Throwable) null);
   }
 
   /**
@@ -57,6 +57,17 @@ public EvalException(Throwable cause) {
     super(getCauseMessage(cause), cause);
   }
 
+  /**
+   * Fills in the callstack if it hasn't been set yet.
+   */
+  @CanIgnoreReturnValue
+  public EvalException withCallStack(List<StarlarkThread.CallStackEntry> callstack) {
+    if (this.callstack == null) {
+      this.callstack = ImmutableList.copyOf(callstack);
+    }
+    return this;
+  }
+
   private static String getCauseMessage(Throwable cause) {
     String msg = cause.getMessage();
     return msg != null ? msg : cause.toString();
@@ -88,6 +99,19 @@ public final ImmutableList<StarlarkThread.CallStackEntry> getCallStack() {
     return callstack != null ? callstack : ImmutableList.of();
   }
 
+  /** Returns the innermost non-builtin location in the call stack, or null if there is none. */
+  @Nullable
+  public Location getInnermostLocation() {
+    if (callstack == null) {
+      return null;
+    }
+    return callstack.reverse().stream()
+        .map(entry -> entry.location)
+        .filter(location -> location != Location.BUILTIN)
+        .findFirst()
+        .orElse(null);
+  }
+
   /** Returns the error message along with its call stack. May be overridden by subclasses. */
   @Override
   public String toString() {
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java
index 5004c7d8d59350..90bd6ec8968a9d 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java
@@ -92,6 +92,7 @@
 import com.google.devtools.build.skyframe.SkyFunction;
 import com.google.devtools.build.skyframe.SkyFunctionName;
 import com.google.devtools.build.skyframe.SkyKey;
+import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -1412,7 +1413,7 @@ public void nonVisibleLabelInLabelAttr() throws Exception {
         "  attrs={'data':attr.label()})",
         "def _ext_impl(ctx):",
         "  data_repo(name='other_repo')",
-        "  data_repo(name='ext',data='@other_repo//:foo')",
+        "  data_repo(name='ext',data='@not_other_repo//:foo')",
         "ext = module_extension(implementation=_ext_impl)");
     scratch.file(workspaceRoot.getRelative("BUILD").getPathString());
     scratch.file(
@@ -1424,9 +1425,10 @@ public void nonVisibleLabelInLabelAttr() throws Exception {
     reporter.removeHandler(failFastHandler);
     evaluator.evaluate(ImmutableList.of(skyKey), evaluationContext);
     assertContainsEvent(
-        "Error in repository_rule: no repository visible as '@other_repo' to the main repository,"
-            + " but referenced by label '@other_repo//:foo' in attribute 'data' of data_repo 'ext'."
-            + " Is the root module missing a bazel_dep or use_repo(..., \"other_repo\")?");
+        """
+            ERROR /ws/defs.bzl:9:12: Traceback (most recent call last):
+            \tFile "/ws/defs.bzl", line 9, column 12, in _ext_impl
+            Error in repository_rule: no repository visible as '@not_other_repo' in the extension '@@//:defs.bzl%ext', but referenced by label '@not_other_repo//:foo' in attribute 'data' of data_repo 'ext'.""");
   }
 
   @Test
@@ -1445,7 +1447,7 @@ public void nonVisibleLabelInLabelAttrNonRootModule() throws Exception {
         "  attrs={'data':attr.label()})",
         "def _ext_impl(ctx):",
         "  data_repo(name='other_repo')",
-        "  data_repo(name='ext',data='@other_repo//:foo')",
+        "  data_repo(name='ext',data='@not_other_repo//:foo')",
         "ext = module_extension(implementation=_ext_impl)");
 
     scratch.file(
@@ -1463,10 +1465,10 @@ public void nonVisibleLabelInLabelAttrNonRootModule() throws Exception {
     reporter.removeHandler(failFastHandler);
     evaluator.evaluate(ImmutableList.of(skyKey), evaluationContext);
     assertContainsEvent(
-        "Error in repository_rule: no repository visible as '@other_repo' to the repository"
-            + " '@@ext_module+', but referenced by label '@other_repo//:foo' in attribute 'data' of"
-            + " data_repo 'ext'. Is the module 'ext_module' missing a bazel_dep or use_repo(...,"
-            + " \"other_repo\")?");
+        """
+            ERROR /usr/local/google/_blaze_jrluser/FAKEMD5/external/ext_module+/defs.bzl:9:12: Traceback (most recent call last):
+            \tFile "/usr/local/google/_blaze_jrluser/FAKEMD5/external/ext_module+/defs.bzl", line 9, column 12, in _ext_impl
+            Error in repository_rule: no repository visible as '@not_other_repo' in the extension '@@ext_module+//:defs.bzl%ext', but referenced by label '@not_other_repo//:foo' in attribute 'data' of data_repo 'ext'.""");
   }
 
   @Test
@@ -1506,10 +1508,7 @@ public void nonVisibleLabelInLabelAttrForwardedFromTag() throws Exception {
     assertThat(result.getError().getException())
         .hasMessageThat()
         .isEqualTo(
-            "in tag at /ws/MODULE.bazel:2:10: no repository visible as '@other_repo' to the main"
-                + " repository, but referenced by label '@other_repo//:foo' in attribute 'label' of"
-                + " tag 'label'. Is the root module missing a bazel_dep or use_repo(...,"
-                + " \"other_repo\")?");
+            "in tag at /ws/MODULE.bazel:2:10: no repository visible as '@other_repo' to the root module, but referenced by label '@other_repo//:foo' in attribute 'label' of tag 'label'.");
   }
 
   @Test
@@ -1528,7 +1527,7 @@ public void nonVisibleLabelInLabelListAttr() throws Exception {
         "  attrs={'data':attr.label_list()})",
         "def _ext_impl(ctx):",
         "  data_repo(name='other_repo')",
-        "  data_repo(name='ext',data=['@other_repo//:foo'])",
+        "  data_repo(name='ext',data=['@not_other_repo//:foo'])",
         "ext = module_extension(implementation=_ext_impl)");
     scratch.file(workspaceRoot.getRelative("BUILD").getPathString());
     scratch.file(
@@ -1540,9 +1539,10 @@ public void nonVisibleLabelInLabelListAttr() throws Exception {
     reporter.removeHandler(failFastHandler);
     evaluator.evaluate(ImmutableList.of(skyKey), evaluationContext);
     assertContainsEvent(
-        "Error in repository_rule: no repository visible as '@other_repo' to the main repository,"
-            + " but referenced by label '@other_repo//:foo' in attribute 'data' of data_repo 'ext'."
-            + " Is the root module missing a bazel_dep or use_repo(..., \"other_repo\")?");
+        """
+            ERROR /ws/defs.bzl:9:12: Traceback (most recent call last):
+            \tFile "/ws/defs.bzl", line 9, column 12, in _ext_impl
+            Error in repository_rule: no repository visible as '@not_other_repo' in the extension '@@//:defs.bzl%ext', but referenced by label '@not_other_repo//:foo' in attribute 'data' of data_repo 'ext'.""");
   }
 
   @Test
@@ -1561,7 +1561,7 @@ public void nonVisibleLabelInLabelKeyedStringDictAttr() throws Exception {
         "  attrs={'data':attr.label_keyed_string_dict()})",
         "def _ext_impl(ctx):",
         "  data_repo(name='other_repo')",
-        "  data_repo(name='ext',data={'@other_repo//:foo':'bar'})",
+        "  data_repo(name='ext',data={'@not_other_repo//:foo':'bar'})",
         "ext = module_extension(implementation=_ext_impl)");
     scratch.file(workspaceRoot.getRelative("BUILD").getPathString());
     scratch.file(
@@ -1573,9 +1573,10 @@ public void nonVisibleLabelInLabelKeyedStringDictAttr() throws Exception {
     reporter.removeHandler(failFastHandler);
     evaluator.evaluate(ImmutableList.of(skyKey), evaluationContext);
     assertContainsEvent(
-        "Error in repository_rule: no repository visible as '@other_repo' to the main repository,"
-            + " but referenced by label '@other_repo//:foo' in attribute 'data' of data_repo 'ext'."
-            + " Is the root module missing a bazel_dep or use_repo(..., \"other_repo\")?");
+        """
+            ERROR /ws/defs.bzl:9:12: Traceback (most recent call last):
+            \tFile "/ws/defs.bzl", line 9, column 12, in _ext_impl
+            Error in repository_rule: no repository visible as '@not_other_repo' in the extension '@@//:defs.bzl%ext', but referenced by label '@not_other_repo//:foo' in attribute 'data' of data_repo 'ext'.""");
   }
 
   @Test
@@ -2982,4 +2983,104 @@ public void innate_invalidAttributeValue() throws Exception {
             "error creating repo data requested at /ws/MODULE.bazel:3:10: failed to instantiate"
                 + " 'data_repo' from this module extension");
   }
+
+  @Test
+  public void extensionRepoMapping() throws Exception {
+    scratch.file(
+        workspaceRoot.getRelative("MODULE.bazel").getPathString(),
+        """
+        bazel_dep(name = "data_repo", version = "1.0")
+        ext = use_extension("//:defs.bzl","ext")
+        use_repo(ext, real_foo = "foo", real_bar = "bar")
+        other_ext = use_extension("//:defs.bzl", "other_ext")
+        use_repo(other_ext, foo = "other_foo", bar = "other_bar")
+        """);
+    scratch.file(workspaceRoot.getRelative("BUILD").getPathString());
+    scratch.file(
+        workspaceRoot.getRelative("data.bzl").getPathString(),
+        """
+        load("@real_foo//:list.bzl", _foo_list = "list")
+        load("@real_bar//:list.bzl", _bar_list = "list")
+        foo_list = _foo_list
+        bar_list = _bar_list
+        """);
+    scratch.file(
+        workspaceRoot.getRelative("defs.bzl").getPathString(),
+        """
+        load("@data_repo//:defs.bzl", "data_repo")
+        def _list_repo_impl(ctx):
+          ctx.file("WORKSPACE")
+          ctx.file("BUILD")
+          labels = [str(Label(l)) for l in ctx.attr.labels]
+          names = [str(Label(n)) for n in ctx.attr.names]
+          ctx.file("list.bzl", "list = " + repr(labels + names))
+        list_repo = repository_rule(
+          implementation = _list_repo_impl,
+          attrs = {
+            "names": attr.string_list(),
+            "labels": attr.label_list(),
+          },
+        )
+        def _ext_impl(ctx):
+          labels = [
+            "@foo//:target1",
+            "@bar//:target2",
+            Label("@foo//:target3"),
+            Label("@bar//:target4"),
+          ]
+          list_repo(
+            name = "foo",
+            labels = labels,
+            names = [
+              "@foo",
+              "@bar",
+            ],
+          )
+
+          # Modify the list passed to "foo" to verify that it is not retained by
+          # reference.
+          labels[0] = "@foo//:target5"
+          labels[1] = "@bar//:target6"
+          labels[2] = Label("@foo//:target7")
+          labels[3] = Label("@bar//:target8")
+          list_repo(
+            name = "bar",
+            labels = labels,
+            names = [
+              "@foo",
+              "@bar",
+            ],
+          )
+        ext = module_extension(implementation = _ext_impl)
+        def _other_ext_impl(ctx):
+          data_repo(name="other_foo",data="other_foo_data")
+          data_repo(name="other_bar",data="other_bar_data")
+        other_ext=module_extension(implementation=_other_ext_impl)
+        """);
+
+    SkyKey skyKey = BzlLoadValue.keyForBuild(Label.parseCanonical("//:data.bzl"));
+    EvaluationResult<BzlLoadValue> result =
+        evaluator.evaluate(ImmutableList.of(skyKey), evaluationContext);
+    if (result.hasError()) {
+      throw result.getError().getException();
+    }
+    assertThat((List<?>) result.get(skyKey).getModule().getGlobal("foo_list"))
+        .containsExactly(
+            "@@+ext+foo//:target1",
+            "@@+ext+bar//:target2",
+            "@@+other_ext+other_foo//:target3",
+            "@@+other_ext+other_bar//:target4",
+            "@@+other_ext+other_foo//:foo",
+            "@@+other_ext+other_bar//:bar")
+        .inOrder();
+    assertThat((List<?>) result.get(skyKey).getModule().getGlobal("bar_list"))
+        .containsExactly(
+            "@@+ext+foo//:target5",
+            "@@+ext+bar//:target6",
+            "@@+other_ext+other_foo//:target7",
+            "@@+other_ext+other_bar//:target8",
+            "@@+other_ext+other_foo//:foo",
+            "@@+other_ext+other_bar//:bar")
+        .inOrder();
+  }
 }
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTagTest.java b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTagTest.java
index 54c8692274be80..8ffcb87bea2d94 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTagTest.java
+++ b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/TypeCheckedTagTest.java
@@ -54,7 +54,7 @@ private static Object getattr(Structure structure, String fieldName) throws Exce
         StarlarkSemantics.DEFAULT,
         structure,
         fieldName,
-        /*defaultValue=*/ null);
+        /* defaultValue= */ null);
   }
 
   @Test
@@ -63,7 +63,8 @@ public void basic() throws Exception {
         TypeCheckedTag.create(
             createTagClass(attr("foo", Type.INTEGER).build()),
             buildTag("tag_name").addAttr("foo", StarlarkInt.of(3)).setDevDependency().build(),
-            /* labelConverter= */ null);
+            /* labelConverter= */ null,
+            "root module");
     assertThat(typeCheckedTag.getFieldNames()).containsExactly("foo");
     assertThat(getattr(typeCheckedTag, "foo")).isEqualTo(StarlarkInt.of(3));
     assertThat(typeCheckedTag.isDevDependency()).isTrue();
@@ -81,7 +82,8 @@ public void label() throws Exception {
                 .build(),
             new LabelConverter(
                 PackageIdentifier.parse("@myrepo//mypkg"),
-                createRepositoryMapping(createModuleKey("test", "1.0"), "repo", "other_repo")));
+                createRepositoryMapping(createModuleKey("test", "1.0"), "repo", "other_repo")),
+            "root module");
     assertThat(typeCheckedTag.getFieldNames()).containsExactly("foo");
     assertThat(getattr(typeCheckedTag, "foo"))
         .isEqualTo(
@@ -101,7 +103,8 @@ public void label_withoutDefaultValue() throws Exception {
             buildTag("tag_name").setDevDependency().build(),
             new LabelConverter(
                 PackageIdentifier.parse("@myrepo//mypkg"),
-                createRepositoryMapping(createModuleKey("test", "1.0"), "repo", "other_repo")));
+                createRepositoryMapping(createModuleKey("test", "1.0"), "repo", "other_repo")),
+            "root module");
     assertThat(typeCheckedTag.getFieldNames()).containsExactly("foo");
     assertThat(getattr(typeCheckedTag, "foo")).isEqualTo(Starlark.NONE);
     assertThat(typeCheckedTag.isDevDependency()).isTrue();
@@ -116,7 +119,8 @@ public void stringListDict_default() throws Exception {
                     .value(ImmutableMap.of("key", ImmutableList.of("value1", "value2")))
                     .build()),
             buildTag("tag_name").build(),
-            null);
+            null,
+            "root module");
     assertThat(typeCheckedTag.getFieldNames()).containsExactly("foo");
     assertThat(getattr(typeCheckedTag, "foo"))
         .isEqualTo(
@@ -138,7 +142,8 @@ public void multipleAttributesAndDefaults() throws Exception {
                 .addAttr("foo", "fooValue")
                 .addAttr("quux", StarlarkList.immutableOf("quuxValue1", "quuxValue2"))
                 .build(),
-            /* labelConverter= */ null);
+            /* labelConverter= */ null,
+            "root module");
     assertThat(typeCheckedTag.getFieldNames()).containsExactly("foo", "bar", "quux");
     assertThat(getattr(typeCheckedTag, "foo")).isEqualTo("fooValue");
     assertThat(getattr(typeCheckedTag, "bar")).isEqualTo(StarlarkInt.of(3));
@@ -156,7 +161,8 @@ public void mandatory() throws Exception {
                 TypeCheckedTag.create(
                     createTagClass(attr("foo", Type.STRING).mandatory().build()),
                     buildTag("tag_name").build(),
-                    /*labelConverter=*/ null));
+                    /* labelConverter= */ null,
+                    "root module"));
     assertThat(e).hasMessageThat().contains("mandatory attribute foo isn't being specified");
   }
 
@@ -172,7 +178,8 @@ public void allowedValues() throws Exception {
                             .allowedValues(new AllowedValueSet("yes", "no"))
                             .build()),
                     buildTag("tag_name").addAttr("foo", "maybe").build(),
-                    /*labelConverter=*/ null));
+                    /* labelConverter= */ null,
+                    "root module"));
     assertThat(e)
         .hasMessageThat()
         .contains("the value for attribute foo has to be one of 'yes' or 'no' instead of 'maybe'");
@@ -187,7 +194,8 @@ public void unknownAttr() throws Exception {
                 TypeCheckedTag.create(
                     createTagClass(attr("foo", Type.STRING).build()),
                     buildTag("tag_name").addAttr("bar", "maybe").build(),
-                    /*labelConverter=*/ null));
+                    /* labelConverter= */ null,
+                    "root module"));
     assertThat(e).hasMessageThat().contains("unknown attribute bar provided");
   }
 }