diff --git a/container/flatten.bzl b/container/flatten.bzl
index 40d117fe6..142ee912e 100644
--- a/container/flatten.bzl
+++ b/container/flatten.bzl
@@ -54,7 +54,7 @@ container_flatten = rule(
         ),
         "_flattener": attr.label(
             default = Label("//container/go/cmd/flattener"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/container/image.bzl b/container/image.bzl
index ceeea01e6..92e0d579c 100644
--- a/container/image.bzl
+++ b/container/image.bzl
@@ -588,7 +588,7 @@ _attrs = dicts.add(_layer.attrs, {
     ),
     "create_image_config": attr.label(
         default = Label("//container/go/cmd/create_image_config:create_image_config"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
@@ -749,7 +749,7 @@ _attrs = dicts.add(_layer.attrs, {
     ),
     "_digester": attr.label(
         default = "//container/go/cmd/digester",
-        cfg = "host",
+        cfg = "exec",
         executable = True,
     ),
 }, _hash_tools, _layer_tools)
diff --git a/container/layer.bzl b/container/layer.bzl
index 938af126e..d7c1732dd 100644
--- a/container/layer.bzl
+++ b/container/layer.bzl
@@ -284,7 +284,7 @@ def _impl(
 _layer_attrs = dicts.add({
     "build_layer": attr.label(
         default = Label("//container:build_tar"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
diff --git a/container/layer_tools.bzl b/container/layer_tools.bzl
index 33ab3fb8c..a15f94e61 100644
--- a/container/layer_tools.bzl
+++ b/container/layer_tools.bzl
@@ -309,7 +309,7 @@ def incremental_load(
 tools = {
     "extract_config": attr.label(
         default = Label("//container/go/cmd/extract_config:extract_config"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
@@ -319,7 +319,7 @@ tools = {
     ),
     "_join_layers": attr.label(
         default = Label("//container/go/cmd/join_layers"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
     ),
 }
diff --git a/container/pull.bzl b/container/pull.bzl
index 921df3cf3..c01249427 100644
--- a/container/pull.bzl
+++ b/container/pull.bzl
@@ -91,25 +91,25 @@ _container_pull_attrs = {
     "puller_darwin": attr.label(
         executable = True,
         default = Label("@go_puller_darwin//file:downloaded"),
-        cfg = "host",
+        cfg = "exec",
         doc = "Exposed to provide a way to test other pullers on macOS",
     ),
     "puller_linux_amd64": attr.label(
         executable = True,
         default = Label("@go_puller_linux_amd64//file:downloaded"),
-        cfg = "host",
+        cfg = "exec",
         doc = "Exposed to provide a way to test other pullers on Linux",
     ),
     "puller_linux_arm64": attr.label(
         executable = True,
         default = Label("@go_puller_linux_arm64//file:downloaded"),
-        cfg = "host",
+        cfg = "exec",
         doc = "Exposed to provide a way to test other pullers on Linux",
     ),
     "puller_linux_s390x": attr.label(
         executable = True,
         default = Label("@go_puller_linux_s390x//file:downloaded"),
-        cfg = "host",
+        cfg = "exec",
         doc = "Exposed to provide a way to test other pullers on Linux",
     ),
     "registry": attr.string(
diff --git a/container/push.bzl b/container/push.bzl
index 855ef8d72..dbf5dab88 100644
--- a/container/push.bzl
+++ b/container/push.bzl
@@ -200,12 +200,12 @@ container_push_ = rule(
         ),
         "_digester": attr.label(
             default = "//container/go/cmd/digester",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
         ),
         "_pusher": attr.label(
             default = "//container/go/cmd/pusher",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/contrib/automatic_container_release/metadata_merge.bzl b/contrib/automatic_container_release/metadata_merge.bzl
index b53505a21..c813dbd73 100644
--- a/contrib/automatic_container_release/metadata_merge.bzl
+++ b/contrib/automatic_container_release/metadata_merge.bzl
@@ -73,7 +73,7 @@ metadata_merge = rule(
         ),
         "_merger": attr.label(
             default = "@io_bazel_rules_docker//contrib/go/cmd/metadata_merge",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             doc = "The go binary that merges a given list of YAML files to " +
                   "produce a single output YAML.",
diff --git a/contrib/automatic_container_release/packages_metadata.bzl b/contrib/automatic_container_release/packages_metadata.bzl
index e531b2d62..211b810db 100644
--- a/contrib/automatic_container_release/packages_metadata.bzl
+++ b/contrib/automatic_container_release/packages_metadata.bzl
@@ -44,7 +44,7 @@ packages_metadata = rule(
         ),
         "_converter": attr.label(
             default = "@io_bazel_rules_docker//contrib/go/cmd/packages_metadata",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
         ),
     },
diff --git a/contrib/compare_ids_test.bzl b/contrib/compare_ids_test.bzl
index e366d0464..7c33adaae 100644
--- a/contrib/compare_ids_test.bzl
+++ b/contrib/compare_ids_test.bzl
@@ -84,7 +84,7 @@ compare_ids_test = rule(
             allow_files = True,
             default = ":compare_ids_test",
             executable = True,
-            cfg = "host",
+            cfg = "exec",
         ),
     },
     test = True,
diff --git a/contrib/passwd.bzl b/contrib/passwd.bzl
index bb9c8bacf..c7e5a625c 100644
--- a/contrib/passwd.bzl
+++ b/contrib/passwd.bzl
@@ -138,7 +138,7 @@ passwd_tar = rule(
     attrs = {
         "build_tar": attr.label(
             default = Label("//container:build_tar"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/contrib/push-all.bzl b/contrib/push-all.bzl
index fd6518b70..a087eb357 100644
--- a/contrib/push-all.bzl
+++ b/contrib/push-all.bzl
@@ -126,7 +126,7 @@ container_push = rule(
         ),
         "_pusher": attr.label(
             default = Label("//container/go/cmd/pusher"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/contrib/repro_test.bzl b/contrib/repro_test.bzl
index 82337c4fa..611d42b8f 100644
--- a/contrib/repro_test.bzl
+++ b/contrib/repro_test.bzl
@@ -309,7 +309,7 @@ container_repro_test = rule(
         ),
         "_extract_image_id": attr.label(
             default = Label("//contrib:extract_image_id"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/docker/package_managers/download_pkgs.bzl b/docker/package_managers/download_pkgs.bzl
index 8646edede..666564c08 100644
--- a/docker/package_managers/download_pkgs.bzl
+++ b/docker/package_managers/download_pkgs.bzl
@@ -177,7 +177,7 @@ _attrs = {
     ),
     "_extract_image_id": attr.label(
         default = Label("//contrib:extract_image_id"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
diff --git a/docker/package_managers/install_pkgs.bzl b/docker/package_managers/install_pkgs.bzl
index 5b12727cf..3437d78bf 100644
--- a/docker/package_managers/install_pkgs.bzl
+++ b/docker/package_managers/install_pkgs.bzl
@@ -173,11 +173,11 @@ _attrs = {
     "_config_stripper": attr.label(
         default = "//docker/util:config_stripper",
         executable = True,
-        cfg = "host",
+        cfg = "exec",
     ),
     "_extract_image_id": attr.label(
         default = Label("//contrib:extract_image_id"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
@@ -195,7 +195,7 @@ _attrs = {
     ),
     "_to_json_tool": attr.label(
         default = Label("//docker/util:to_json"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
diff --git a/docker/security/security_check.bzl b/docker/security/security_check.bzl
index 905f7dfe9..6619bb7d2 100644
--- a/docker/security/security_check.bzl
+++ b/docker/security/security_check.bzl
@@ -81,14 +81,14 @@ security_check = rule(
         # JSON to YAML converter.
         "_json_to_yaml": attr.label(
             default = Label("@io_bazel_rules_docker//docker/security/cmd/json_to_yaml"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
         # The security checker python executable.
         "_security_check": attr.label(
             default = Label("@io_bazel_rules_docker//docker/security:security_check"),
-            cfg = "host",
+            cfg = "exec",
             executable = True,
             allow_files = True,
         ),
diff --git a/docker/toolchain_container/debian_pkg_tar.bzl b/docker/toolchain_container/debian_pkg_tar.bzl
index e1d8cba68..3b3f3a7bb 100644
--- a/docker/toolchain_container/debian_pkg_tar.bzl
+++ b/docker/toolchain_container/debian_pkg_tar.bzl
@@ -50,7 +50,7 @@ aggregate_debian_pkgs_attrs = {
     "language_layers": attr.label_list(),
     "_extract_image_id": attr.label(
         default = Label("//contrib:extract_image_id"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
diff --git a/docker/util/run.bzl b/docker/util/run.bzl
index eedb488d4..0529f974f 100644
--- a/docker/util/run.bzl
+++ b/docker/util/run.bzl
@@ -130,7 +130,7 @@ _extract_attrs = {
     ),
     "_extract_image_id": attr.label(
         default = Label("//contrib:extract_image_id"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
@@ -257,7 +257,7 @@ _commit_attrs = {
     ),
     "_extract_image_id": attr.label(
         default = Label("//contrib:extract_image_id"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
@@ -271,7 +271,7 @@ _commit_attrs = {
     ),
     "_to_json_tool": attr.label(
         default = Label("//docker/util:to_json"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
@@ -440,7 +440,7 @@ _commit_layer_attrs = dicts.add({
     ),
     "_extract_image_id": attr.label(
         default = Label("//contrib:extract_image_id"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
@@ -450,7 +450,7 @@ _commit_layer_attrs = dicts.add({
     ),
     "_last_layer_extractor_tool": attr.label(
         default = Label("//contrib:extract_last_layer"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
diff --git a/skylib/hash.bzl b/skylib/hash.bzl
index 3f27c357d..2ab221588 100644
--- a/skylib/hash.bzl
+++ b/skylib/hash.bzl
@@ -35,7 +35,7 @@ def sha256(ctx, artifact, execution_requirements = None):
 tools = {
     "sha256": attr.label(
         default = Label("//container/go/cmd/sha256:sha256"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
         allow_files = True,
     ),
diff --git a/skylib/zip.bzl b/skylib/zip.bzl
index b8a7d6d1a..e5a103784 100644
--- a/skylib/zip.bzl
+++ b/skylib/zip.bzl
@@ -120,7 +120,7 @@ def gunzip(ctx, artifact):
 tools = {
     "_zipper": attr.label(
         default = Label("//container/go/cmd/zipper"),
-        cfg = "host",
+        cfg = "exec",
         executable = True,
     ),
 }
diff --git a/toolchains/docker/toolchain.bzl b/toolchains/docker/toolchain.bzl
index 7b925bcbf..a7bbf9441 100644
--- a/toolchains/docker/toolchain.bzl
+++ b/toolchains/docker/toolchain.bzl
@@ -63,7 +63,7 @@ docker_toolchain = rule(
         "build_tar_target": attr.label(
             allow_files = True,
             doc = "Bazel target for the build_tar tool.",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
         ),
         # client_config cannot be a Bazel label because this attribute will be used in
@@ -89,7 +89,7 @@ docker_toolchain = rule(
             allow_files = True,
             doc = "Bazel target for the gzip tool. " +
                   "Should only be set if gzip_path is unset.",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
         ),
         "tool_path": attr.string(
@@ -99,7 +99,7 @@ docker_toolchain = rule(
             allow_files = True,
             doc = "Bazel target for the docker tool. " +
                   "Should only be set if tool_path is unset.",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
         ),
         "xz_path": attr.string(
@@ -110,7 +110,7 @@ docker_toolchain = rule(
             allow_files = True,
             doc = "Bazel target for the xz tool. " +
                   "Should only be set if xz_path is unset.",
-            cfg = "host",
+            cfg = "exec",
             executable = True,
         ),
     },
@@ -189,7 +189,7 @@ toolchain_configure = repository_rule(
     attrs = {
         "build_tar_target": attr.label(
             executable = True,
-            cfg = "host",
+            cfg = "exec",
             allow_files = True,
             mandatory = False,
             doc = "The bazel target for the build_tar tool.",
@@ -233,7 +233,7 @@ toolchain_configure = repository_rule(
         ),
         "gzip_target": attr.label(
             executable = True,
-            cfg = "host",
+            cfg = "exec",
             allow_files = True,
             mandatory = False,
             doc = "The bazel target for the gzip tool. " +
@@ -247,7 +247,7 @@ toolchain_configure = repository_rule(
         ),
         "xz_target": attr.label(
             executable = True,
-            cfg = "host",
+            cfg = "exec",
             allow_files = True,
             mandatory = False,
             doc = "The bazel target for the xz tool. " +