diff --git a/.bazelrc b/.bazelrc
index 5df0bd273f70..11c2d33dfbb5 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,6 +14,7 @@ common --color=yes
 common --curses=auto
 
 build --experimental_ui_max_stdouterr_bytes=10485760
+# required to build shared library on macOS
 build --experimental_cc_shared_library
 
 build --show_progress_rate_limit=0
diff --git a/build/BUILD.bazel b/build/BUILD.bazel
index 7edee81d91d6..bd9e7cacfa0f 100644
--- a/build/BUILD.bazel
+++ b/build/BUILD.bazel
@@ -103,7 +103,7 @@ kong_directory_genrule(
         "@openresty",
         "@openresty//:luajit",
         "@protoc//:all_srcs",
-        "@snappy//:snappy",
+        "@snappy//:snappy-lib",
     ] + select({
         "@kong//:skip_webui_flags": [],
         "//conditions:default": [
@@ -153,7 +153,7 @@ kong_directory_genrule(
         tar -cC ${LUAJIT}/share . | tar -xC ${BUILD_DESTDIR}/openresty/luajit/share
         chmod -R "+rw" ${BUILD_DESTDIR}/openresty/luajit
 
-        SNAPPY=${WORKSPACE_PATH}/$(dirname $(echo '$(locations @snappy//:snappy)' | awk '{print $1}'))
+        SNAPPY=${WORKSPACE_PATH}/$(dirname $(echo '$(locations @snappy//:snappy-lib)' | awk '{print $1}'))
         cp ${SNAPPY}/libsnappy.${libext} ${BUILD_DESTDIR}/kong/lib
 
         LUAROCKS=${WORKSPACE_PATH}/$(dirname '$(location @luarocks//:luarocks_make)')/luarocks_tree
diff --git a/build/openresty/snappy/BUILD.bazel b/build/openresty/snappy/BUILD.bazel
index 69f23d1ffe87..3f534e9b52ed 100644
--- a/build/openresty/snappy/BUILD.bazel
+++ b/build/openresty/snappy/BUILD.bazel
@@ -59,7 +59,7 @@ cc_library(
 )
 
 cc_library(
-    name = "snappy.a",
+    name = "snappy",
     srcs = [
         "snappy.cc",
         "snappy-c.cc",
@@ -84,9 +84,19 @@ cc_library(
     ],
 )
 
+# workaround for apple_cc_toolchain doesn't support dynamic linker feature
 cc_shared_library(
-    name = "snappy",
-    deps = [":snappy.a"],
+    name = "snappy-macos-lib",
+    shared_lib_name = "libsnappy.dylib",
+    deps = [":snappy"],
+)
+
+alias(
+    name = "snappy-lib",
+    actual = select({
+        "@platforms//os:osx": ":snappy-macos-lib",
+        "//conditions:default": ":snappy",
+    }),
 )
 
 filegroup(
diff --git a/build/repositories.bzl b/build/repositories.bzl
index c6ca9720d78b..b216e569d770 100644
--- a/build/repositories.bzl
+++ b/build/repositories.bzl
@@ -8,6 +8,7 @@ load("//build/cross_deps:repositories.bzl", "cross_deps_repositories")
 load("//build/libexpat:repositories.bzl", "libexpat_repositories")
 load("//build:build_system.bzl", "github_release")
 load("@kong_bindings//:variables.bzl", "KONG_VAR")
+load("//build/toolchain:bindings.bzl", "load_bindings")
 
 _SRCS_BUILD_FILE_CONTENT = """
 filegroup(
@@ -75,6 +76,8 @@ def kong_resty_websocket_repositories():
     )
 
 def build_repositories():
+    load_bindings(name = "toolchain_bindings")
+
     libexpat_repositories()
     luarocks_repositories()
 
diff --git a/build/toolchain/BUILD b/build/toolchain/BUILD
index 9b870846acf7..be5811521f10 100644
--- a/build/toolchain/BUILD
+++ b/build/toolchain/BUILD
@@ -28,7 +28,7 @@ cc_toolchain_config(
     compiler_configuration = {},
     target_cpu = "aarch64",
     toolchain_path_prefix = "/usr/aarch64-linux-gnu/",  # is this required?
-    tools_path_prefix = "/usr/bin/aarch64-linux-gnu-",
+    tools_prefix = "aarch64-linux-gnu-",
 )
 
 cc_toolchain(
diff --git a/build/toolchain/bindings.bzl b/build/toolchain/bindings.bzl
new file mode 100644
index 000000000000..6669e8c46300
--- /dev/null
+++ b/build/toolchain/bindings.bzl
@@ -0,0 +1,13 @@
+"""
+Global variables
+"""
+
+def _load_bindings_impl(ctx):
+    root = "/".join(ctx.execute(["pwd"]).stdout.split("/")[:-1])
+
+    ctx.file("BUILD.bazel", "")
+    ctx.file("variables.bzl", "INTERNAL_ROOT = \"%s\"\n" % root)
+
+load_bindings = repository_rule(
+    implementation = _load_bindings_impl,
+)
diff --git a/build/toolchain/cc_toolchain_config.bzl b/build/toolchain/cc_toolchain_config.bzl
index 38380c4f9f03..f72fb3f4b33b 100644
--- a/build/toolchain/cc_toolchain_config.bzl
+++ b/build/toolchain/cc_toolchain_config.bzl
@@ -12,8 +12,43 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "tool_path")
-load("@kong_bindings//:variables.bzl", "KONG_VAR")
+load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool_path", "with_feature_set")
+load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
+load("@toolchain_bindings//:variables.bzl", "INTERNAL_ROOT")
+
+all_compile_actions = [
+    ACTION_NAMES.c_compile,
+    ACTION_NAMES.cpp_compile,
+    ACTION_NAMES.linkstamp_compile,
+    ACTION_NAMES.assemble,
+    ACTION_NAMES.preprocess_assemble,
+    ACTION_NAMES.cpp_header_parsing,
+    ACTION_NAMES.cpp_module_compile,
+    ACTION_NAMES.cpp_module_codegen,
+    ACTION_NAMES.clif_match,
+    ACTION_NAMES.lto_backend,
+]
+
+all_cpp_compile_actions = [
+    ACTION_NAMES.cpp_compile,
+    ACTION_NAMES.linkstamp_compile,
+    ACTION_NAMES.cpp_header_parsing,
+    ACTION_NAMES.cpp_module_compile,
+    ACTION_NAMES.cpp_module_codegen,
+    ACTION_NAMES.clif_match,
+]
+
+all_link_actions = [
+    ACTION_NAMES.cpp_link_executable,
+    ACTION_NAMES.cpp_link_dynamic_library,
+    ACTION_NAMES.cpp_link_nodeps_dynamic_library,
+]
+
+lto_index_actions = [
+    ACTION_NAMES.lto_index_for_executable,
+    ACTION_NAMES.lto_index_for_dynamic_library,
+    ACTION_NAMES.lto_index_for_nodeps_dynamic_library,
+]
 
 # Bazel 4.* doesn't support nested starlark functions, so we cannot simplify
 #_fmt_flags() by defining it as a nested function.
@@ -25,9 +60,23 @@ def _fmt_flags(flags, toolchain_path_prefix):
 def _cc_toolchain_config_impl(ctx):
     target_cpu = ctx.attr.target_cpu
     toolchain_path_prefix = ctx.attr.toolchain_path_prefix
-    tools_path_prefix = ctx.attr.tools_path_prefix
+    tools_prefix = ctx.attr.tools_prefix
     compiler_configuration = ctx.attr.compiler_configuration
 
+    # update to absolute paths if we are using a managed toolchain (downloaded by bazel)
+    if len(ctx.files.src) > 0:
+        if toolchain_path_prefix:
+            fail("Both `src` and `toolchain_path_prefix` is set, but toolchain_path_prefix will be overrided if `src` is set.")
+
+        # file is something like external/aarch64-rhel9-linux-gnu-gcc-11/aarch64-rhel9-linux-gnu/bin/ar
+        # we will take aarch64-rhel9-linux-gnu-gcc-11/aarch64-rhel9-linux-gnu
+        toolchain_path_prefix = INTERNAL_ROOT + "/" + "/".join(ctx.files.src[0].path.split("/")[1:3])
+
+        _tools_root_dir = INTERNAL_ROOT + "/" + ctx.files.src[0].path.split("/")[1]
+        tools_prefix = _tools_root_dir + "/bin/" + tools_prefix
+    else:
+        tools_prefix = "/usr/bin/" + tools_prefix
+
     # Unfiltered compiler flags; these are placed at the end of the command
     # line, so take precendence over any user supplied flags through --copts or
     # such.
@@ -50,10 +99,7 @@ def _cc_toolchain_config_impl(ctx):
         "-fstack-protector",
         "-fno-omit-frame-pointer",
         # Diagnostics
-        "-fcolor-diagnostics",
         "-Wall",
-        "-Wthread-safety",
-        "-Wself-assign",
     ]
 
     dbg_compile_flags = ["-g", "-fstandalone-debug"]
@@ -70,6 +116,7 @@ def _cc_toolchain_config_impl(ctx):
     link_flags = [
         # "--target=" + target_system_name,
         "-lm",
+        "-lstdc++",
         "-no-canonical-prefixes",
     ]
 
@@ -82,7 +129,6 @@ def _cc_toolchain_config_impl(ctx):
     # only option.
 
     link_flags.extend([
-        "-fuse-ld=lld",
         "-Wl,--build-id=md5",
         "-Wl,--hash-style=gnu",
         "-Wl,-z,relro,-z,now",
@@ -100,9 +146,20 @@ def _cc_toolchain_config_impl(ctx):
     # C++ built-in include directories:
     cxx_builtin_include_directories = [
         "/usr/" + target_cpu + "-linux-gnu/include",
+        # let's just add any version we might need in here (debian based)
+        "/usr/lib/gcc-cross/" + target_cpu + "-linux-gnu/13/include",
+        "/usr/lib/gcc-cross/" + target_cpu + "-linux-gnu/12/include",
         "/usr/lib/gcc-cross/" + target_cpu + "-linux-gnu/11/include",
+        "/usr/lib/gcc-cross/" + target_cpu + "-linux-gnu/10/include",
     ]
 
+    if len(ctx.files.src) > 0:
+        # define absolute path for managed toolchain
+        # bazel doesn't support relative path for cxx_builtin_include_directories
+        cxx_builtin_include_directories.append(toolchain_path_prefix + "/include")
+        cxx_builtin_include_directories.append(toolchain_path_prefix + "/sysroot/usr/include")
+        cxx_builtin_include_directories.append(_tools_root_dir + "/lib/gcc")
+
     # sysroot_path = compiler_configuration["sysroot_path"]
     # sysroot_prefix = ""
     # if sysroot_path:
@@ -125,39 +182,39 @@ def _cc_toolchain_config_impl(ctx):
     tool_paths = [
         tool_path(
             name = "ar",
-            path = tools_path_prefix + "ar",
+            path = tools_prefix + "ar",
         ),
         tool_path(
             name = "cpp",
-            path = tools_path_prefix + "g++",
+            path = tools_prefix + "g++",
         ),
         tool_path(
             name = "gcc",
-            path = tools_path_prefix + "gcc",
+            path = tools_prefix + "gcc",
         ),
         tool_path(
             name = "gcov",
-            path = tools_path_prefix + "gcov",
+            path = tools_prefix + "gcov",
         ),
         tool_path(
             name = "ld",
-            path = tools_path_prefix + ctx.attr.ld,
+            path = tools_prefix + ctx.attr.ld,
         ),
         tool_path(
             name = "nm",
-            path = tools_path_prefix + "nm",
+            path = tools_prefix + "nm",
         ),
         tool_path(
             name = "objcopy",
-            path = tools_path_prefix + "objcopy",
+            path = tools_prefix + "objcopy",
         ),
         tool_path(
             name = "objdump",
-            path = tools_path_prefix + "objdump",
+            path = tools_prefix + "objdump",
         ),
         tool_path(
             name = "strip",
-            path = tools_path_prefix + "strip",
+            path = tools_prefix + "strip",
         ),
     ]
 
@@ -165,29 +222,124 @@ def _cc_toolchain_config_impl(ctx):
 
     # Replace flags with any user-provided overrides.
     if "compile_flags" in compiler_configuration:
-        compile_flags = _fmt_flags(compiler_configuration["compile_flags"], toolchain_path_prefix)
+        compile_flags = compile_flags + _fmt_flags(compiler_configuration["compile_flags"], toolchain_path_prefix)
     if "cxx_flags" in compiler_configuration:
-        cxx_flags = _fmt_flags(compiler_configuration["cxx_flags"], toolchain_path_prefix)
+        cxx_flags = cxx_flags + _fmt_flags(compiler_configuration["cxx_flags"], toolchain_path_prefix)
     if "link_flags" in compiler_configuration:
-        link_flags = _fmt_flags(compiler_configuration["link_flags"], toolchain_path_prefix)
+        link_flags = link_flags + _fmt_flags(compiler_configuration["link_flags"], toolchain_path_prefix)
     if "link_libs" in compiler_configuration:
-        link_libs = _fmt_flags(compiler_configuration["link_libs"], toolchain_path_prefix)
+        link_libs = link_libs + _fmt_flags(compiler_configuration["link_libs"], toolchain_path_prefix)
     if "opt_compile_flags" in compiler_configuration:
-        opt_compile_flags = _fmt_flags(compiler_configuration["opt_compile_flags"], toolchain_path_prefix)
+        opt_compile_flags = opt_compile_flags + _fmt_flags(compiler_configuration["opt_compile_flags"], toolchain_path_prefix)
     if "opt_link_flags" in compiler_configuration:
-        opt_link_flags = _fmt_flags(compiler_configuration["opt_link_flags"], toolchain_path_prefix)
+        opt_link_flags = opt_link_flags + _fmt_flags(compiler_configuration["opt_link_flags"], toolchain_path_prefix)
     if "dbg_compile_flags" in compiler_configuration:
-        dbg_compile_flags = _fmt_flags(compiler_configuration["dbg_compile_flags"], toolchain_path_prefix)
+        dbg_compile_flags = dbg_compile_flags + _fmt_flags(compiler_configuration["dbg_compile_flags"], toolchain_path_prefix)
     if "coverage_compile_flags" in compiler_configuration:
-        coverage_compile_flags = _fmt_flags(compiler_configuration["coverage_compile_flags"], toolchain_path_prefix)
+        coverage_compile_flags = coverage_compile_flags + _fmt_flags(compiler_configuration["coverage_compile_flags"], toolchain_path_prefix)
     if "coverage_link_flags" in compiler_configuration:
-        coverage_link_flags = _fmt_flags(compiler_configuration["coverage_link_flags"], toolchain_path_prefix)
+        coverage_link_flags = coverage_link_flags + _fmt_flags(compiler_configuration["coverage_link_flags"], toolchain_path_prefix)
     if "unfiltered_compile_flags" in compiler_configuration:
-        unfiltered_compile_flags = _fmt_flags(compiler_configuration["unfiltered_compile_flags"], toolchain_path_prefix)
+        unfiltered_compile_flags = unfiltered_compile_flags + _fmt_flags(compiler_configuration["unfiltered_compile_flags"], toolchain_path_prefix)
+
+    default_compile_flags_feature = feature(
+        name = "default_compile_flags",
+        enabled = True,
+        flag_sets = [
+            flag_set(
+                actions = all_compile_actions,
+                flag_groups = ([
+                    flag_group(
+                        flags = compile_flags,
+                    ),
+                ] if compile_flags else []),
+            ),
+            flag_set(
+                actions = all_compile_actions,
+                flag_groups = ([
+                    flag_group(
+                        flags = dbg_compile_flags,
+                    ),
+                ] if dbg_compile_flags else []),
+                with_features = [with_feature_set(features = ["dbg"])],
+            ),
+            flag_set(
+                actions = all_compile_actions,
+                flag_groups = ([
+                    flag_group(
+                        flags = opt_compile_flags,
+                    ),
+                ] if opt_compile_flags else []),
+                with_features = [with_feature_set(features = ["opt"])],
+            ),
+            flag_set(
+                actions = all_cpp_compile_actions + [ACTION_NAMES.lto_backend],
+                flag_groups = ([
+                    flag_group(
+                        flags = cxx_flags,
+                    ),
+                ] if cxx_flags else []),
+            ),
+        ],
+    )
+
+    default_link_flags_feature = feature(
+        name = "default_link_flags",
+        enabled = True,
+        flag_sets = [
+            flag_set(
+                actions = all_link_actions + lto_index_actions,
+                flag_groups = ([
+                    flag_group(
+                        flags = link_flags,
+                    ),
+                ] if link_flags else []),
+            ),
+            flag_set(
+                actions = all_link_actions + lto_index_actions,
+                flag_groups = ([
+                    flag_group(
+                        flags = opt_link_flags,
+                    ),
+                ] if opt_link_flags else []),
+                with_features = [with_feature_set(features = ["opt"])],
+            ),
+        ],
+    )
+
+    unfiltered_compile_flags_feature = feature(
+        name = "unfiltered_compile_flags",
+        enabled = True,
+        flag_sets = [
+            flag_set(
+                actions = all_compile_actions,
+                flag_groups = ([
+                    flag_group(
+                        flags = unfiltered_compile_flags,
+                    ),
+                ] if unfiltered_compile_flags else []),
+            ),
+        ],
+    )
+
+    supports_pic_feature = feature(name = "supports_pic", enabled = True)
+    supports_dynamic_linker_feature = feature(name = "supports_dynamic_linker", enabled = True)
+    dbg_feature = feature(name = "dbg")
+    opt_feature = feature(name = "opt")
+    features = [
+        supports_dynamic_linker_feature,
+        supports_pic_feature,
+        dbg_feature,
+        opt_feature,
+        default_compile_flags_feature,
+        unfiltered_compile_flags_feature,
+        default_link_flags_feature,
+    ]
 
     return cc_common.create_cc_toolchain_config_info(
         ctx = ctx,
         compiler = "gcc",
+        features = features,
         toolchain_identifier = target_cpu + "-linux-gnu",
         host_system_name = "local",
         target_cpu = target_cpu,
@@ -203,11 +355,12 @@ cc_toolchain_config = rule(
     implementation = _cc_toolchain_config_impl,
     attrs = {
         "target_cpu": attr.string(),
-        "toolchain_path_prefix": attr.string(),
-        "tools_path_prefix": attr.string(),
+        "toolchain_path_prefix": attr.string(doc = "The root directory of the toolchain."),
+        "tools_prefix": attr.string(doc = "The tools prefix, for example aarch64-linux-gnu-"),
         "compiler_configuration": attr.string_list_dict(allow_empty = True, default = {}),
         "target_libc": attr.string(default = "gnu"),
         "ld": attr.string(default = "gcc"),
+        "src": attr.label(doc = "Reference to the managed toolchain repository, if set, toolchain_path_prefix will not be used and tools_prefix will be infered "),
     },
     provides = [CcToolchainConfigInfo],
 )
diff --git a/build/toolchain/managed_toolchain.bzl b/build/toolchain/managed_toolchain.bzl
index 793b335924e9..33c9001fc5a1 100644
--- a/build/toolchain/managed_toolchain.bzl
+++ b/build/toolchain/managed_toolchain.bzl
@@ -7,45 +7,6 @@ aarch64_glibc_distros = {
     "aws2": "7",
 }
 
-def _generate_wrappers_impl(ctx):
-    wrapper_file = ctx.actions.declare_file("wrapper")
-    ctx.actions.expand_template(
-        template = ctx.file._wrapper_template,
-        output = wrapper_file,
-        substitutions = {
-            "{{TOOLCHAIN_NAME}}": ctx.attr.toolchain_name,
-        },
-        is_executable = True,
-    )
-
-    dummy_output = ctx.actions.declare_file(ctx.attr.name + ".wrapper-marker")
-
-    ctx.actions.run_shell(
-        command = "build/toolchain/generate_wrappers.sh %s %s %s %s" % (
-            ctx.attr.toolchain_name,
-            wrapper_file.path,
-            ctx.attr.tools_prefix,
-            dummy_output.path,
-        ),
-        progress_message = "Create wrappers for " + ctx.attr.toolchain_name,
-        inputs = [wrapper_file],
-        outputs = [dummy_output],
-    )
-
-    return [DefaultInfo(files = depset([dummy_output, wrapper_file]))]
-
-generate_wrappers = rule(
-    implementation = _generate_wrappers_impl,
-    attrs = {
-        "toolchain_name": attr.string(mandatory = True),
-        "tools_prefix": attr.string(mandatory = True),
-        "_wrapper_template": attr.label(
-            default = "//build/toolchain:templates/wrapper",
-            allow_single_file = True,
-        ),
-    },
-)
-
 def define_managed_toolchain(
         name = None,
         arch = "x86_64",
@@ -86,30 +47,16 @@ def define_managed_toolchain(
         ld = ld,
         target_cpu = arch,
         target_libc = libc,
-        toolchain_path_prefix = "wrappers-%s/" % identifier,  # is this required?
-        tools_path_prefix = "wrappers-%s/%s" % (identifier, tools_prefix),
-    )
-
-    generate_wrappers(
-        name = "%s_wrappers" % identifier,
-        toolchain_name = identifier,
         tools_prefix = tools_prefix,
-    )
-
-    native.filegroup(
-        name = "%s_files" % identifier,
-        srcs = [
-            ":%s_wrappers" % identifier,
-            "@%s//:toolchain" % identifier,
-        ],
+        src = "@%s//:toolchain" % identifier,
     )
 
     native.cc_toolchain(
         name = "%s_cc_toolchain" % identifier,
-        all_files = ":%s_files" % identifier,
-        compiler_files = ":%s_files" % identifier,
+        all_files = "@%s//:toolchain" % identifier,
+        compiler_files = "@%s//:toolchain" % identifier,
         dwp_files = ":empty",
-        linker_files = "%s_files" % identifier,
+        linker_files = "@%s//:toolchain" % identifier,
         objcopy_files = ":empty",
         strip_files = ":empty",
         supports_param_files = 0,
diff --git a/build/toolchain/templates/wrapper b/build/toolchain/templates/wrapper
deleted file mode 100644
index cb52306cfca1..000000000000
--- a/build/toolchain/templates/wrapper
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash
-
-PREFIX=
-if [[ ! -z ${EXT_BUILD_ROOT} ]]; then
-    PREFIX=${EXT_BUILD_ROOT}/
-elif [[ ! -e external/{{TOOLCHAIN_NAME}}/bin ]]; then
-    echo "EXT_BUILD_ROOT is not set and wrapper can't find the toolchain, is this script running with the correct environment (foreign_cc rules, cc_* rules)?"
-    exit 1
-fi
-
-NAME=$(/usr/bin/basename "$0")
-TOOLCHAIN_BINDIR=${PREFIX}external/{{TOOLCHAIN_NAME}}/bin
- 
-exec "${TOOLCHAIN_BINDIR}"/"${NAME}" "$@"
\ No newline at end of file
diff --git a/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt b/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt
index 3f759cfe241a..83e403555d10 100644
--- a/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt
+++ b/scripts/explain_manifest/fixtures/amazonlinux-2-amd64.txt
@@ -61,6 +61,13 @@
   - libm.so.6
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt b/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt
index 1475038b6e31..b962f79b5ed7 100644
--- a/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt
+++ b/scripts/explain_manifest/fixtures/amazonlinux-2023-amd64.txt
@@ -56,6 +56,13 @@
   - libm.so.6
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt b/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt
index f2e42a900694..57e21512d51b 100644
--- a/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt
+++ b/scripts/explain_manifest/fixtures/amazonlinux-2023-arm64.txt
@@ -13,48 +13,77 @@
 
 - Path      : /usr/local/kong/lib/engines-3/afalg.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/engines-3/capi.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/engines-3/loader_attic.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/engines-3/padlock.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/libcrypto.so.3
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/libexpat.so.1.9.2
   Needed    :
   - libm.so.6
+  - libstdc++.so.6
+  - libc.so.6
+  - ld-linux-aarch64.so.1
+
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libm.so.6
+  - libstdc++.so.6
+  - libgcc_s.so.1
   - libc.so.6
+  - ld-linux-aarch64.so.1
 
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/ossl-modules/legacy.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/lib/lua/5.1/lfs.so
@@ -163,6 +192,7 @@
   - libcrypto.so.3
   - libz.so.1
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/openresty/luajit/lib:/usr/local/kong/lib:/usr/local/openresty/lualib
   Modules   :
   - lua-kong-nginx-module
diff --git a/scripts/explain_manifest/fixtures/debian-10-amd64.txt b/scripts/explain_manifest/fixtures/debian-10-amd64.txt
index cfc938ae3499..48f6dda84757 100644
--- a/scripts/explain_manifest/fixtures/debian-10-amd64.txt
+++ b/scripts/explain_manifest/fixtures/debian-10-amd64.txt
@@ -61,6 +61,13 @@
   - libm.so.6
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/debian-11-amd64.txt b/scripts/explain_manifest/fixtures/debian-11-amd64.txt
index 5eed8dc87a71..672c184e10cb 100644
--- a/scripts/explain_manifest/fixtures/debian-11-amd64.txt
+++ b/scripts/explain_manifest/fixtures/debian-11-amd64.txt
@@ -59,6 +59,13 @@
   Needed    :
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/debian-12-amd64.txt b/scripts/explain_manifest/fixtures/debian-12-amd64.txt
index 687623bfeb2c..2ec1965787d4 100644
--- a/scripts/explain_manifest/fixtures/debian-12-amd64.txt
+++ b/scripts/explain_manifest/fixtures/debian-12-amd64.txt
@@ -54,6 +54,13 @@
   Needed    :
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/el7-amd64.txt b/scripts/explain_manifest/fixtures/el7-amd64.txt
index 95122d3d6501..95397a5fd0ef 100644
--- a/scripts/explain_manifest/fixtures/el7-amd64.txt
+++ b/scripts/explain_manifest/fixtures/el7-amd64.txt
@@ -61,6 +61,13 @@
   - libm.so.6
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/el8-amd64.txt b/scripts/explain_manifest/fixtures/el8-amd64.txt
index 1553481b6141..fe385e2cb6f1 100644
--- a/scripts/explain_manifest/fixtures/el8-amd64.txt
+++ b/scripts/explain_manifest/fixtures/el8-amd64.txt
@@ -61,6 +61,13 @@
   - libm.so.6
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/el9-amd64.txt b/scripts/explain_manifest/fixtures/el9-amd64.txt
index bfe5a9a06fa3..977c13d06eea 100644
--- a/scripts/explain_manifest/fixtures/el9-amd64.txt
+++ b/scripts/explain_manifest/fixtures/el9-amd64.txt
@@ -56,6 +56,13 @@
   - libm.so.6
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/el9-arm64.txt b/scripts/explain_manifest/fixtures/el9-arm64.txt
index f2e42a900694..57e21512d51b 100644
--- a/scripts/explain_manifest/fixtures/el9-arm64.txt
+++ b/scripts/explain_manifest/fixtures/el9-arm64.txt
@@ -13,48 +13,77 @@
 
 - Path      : /usr/local/kong/lib/engines-3/afalg.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/engines-3/capi.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/engines-3/loader_attic.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/engines-3/padlock.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/libcrypto.so.3
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/libexpat.so.1.9.2
   Needed    :
   - libm.so.6
+  - libstdc++.so.6
+  - libc.so.6
+  - ld-linux-aarch64.so.1
+
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libm.so.6
+  - libstdc++.so.6
+  - libgcc_s.so.1
   - libc.so.6
+  - ld-linux-aarch64.so.1
 
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/kong/lib/ossl-modules/legacy.so
   Needed    :
+  - libm.so.6
+  - libstdc++.so.6
   - libcrypto.so.3
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/kong/lib
 
 - Path      : /usr/local/lib/lua/5.1/lfs.so
@@ -163,6 +192,7 @@
   - libcrypto.so.3
   - libz.so.1
   - libc.so.6
+  - ld-linux-aarch64.so.1
   Rpath     : /usr/local/openresty/luajit/lib:/usr/local/kong/lib:/usr/local/openresty/lualib
   Modules   :
   - lua-kong-nginx-module
diff --git a/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt b/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt
index d0103ac00df7..646e70445e96 100644
--- a/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt
+++ b/scripts/explain_manifest/fixtures/ubuntu-20.04-amd64.txt
@@ -59,6 +59,13 @@
   Needed    :
   - libc.so.6
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libstdc++.so.6
diff --git a/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt b/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt
index 12545ec6e5fe..f5966d758f00 100644
--- a/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt
+++ b/scripts/explain_manifest/fixtures/ubuntu-22.04-arm64.txt
@@ -42,6 +42,13 @@
   - libc.so.6
   - ld-linux-aarch64.so.1
 
+- Path      : /usr/local/kong/lib/libsnappy.so
+  Needed    :
+  - libstdc++.so.6
+  - libgcc_s.so.1
+  - libc.so.6
+  - ld-linux-aarch64.so.1
+
 - Path      : /usr/local/kong/lib/libssl.so.3
   Needed    :
   - libcrypto.so.3