diff --git a/Dockerfile b/Dockerfile
index 668ddeac..8e2a52ce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -280,8 +280,8 @@ FROM sdk-libc AS sdk-rust
 
 USER root
 RUN \
-  mkdir -p /usr/libexec/rust && \
-  chown -R builder:builder /usr/libexec/rust
+  mkdir -p /usr/libexec/{rust,llvm} && \
+  chown -R builder:builder /usr/libexec/{rust,llvm}
 
 ARG HOST_ARCH
 ENV VENDOR="bottlerocket"
@@ -332,7 +332,10 @@ COPY ./configs/rust/targets ./targets
 COPY ./configs/rust/config.toml.in ./
 RUN \
   sed -e "s,@HOST_TRIPLE@,${HOST_ARCH}-unknown-linux-gnu,g" config.toml.in > config.toml && \
-  RUSTUP_DIST_SERVER=example:// RUST_TARGET_PATH=${PWD}/targets python3 ./x.py install && \
+  RUSTUP_DIST_SERVER=example:// RUST_TARGET_PATH=${PWD}/targets python3 ./x.py install
+
+# Copy target configs into the installed Rust environment.
+RUN \
   for arch in x86_64 aarch64 ; do \
     for libc in gnu musl ; do \
       cp \
@@ -341,6 +344,11 @@ RUN \
     done ; \
   done
 
+# Copy out the LLVM toolchain that was built along with Rust.
+RUN \
+  rm -rf "build/${HOST_ARCH}-unknown-linux-gnu/llvm/build" && \
+  rsync -aq "build/${HOST_ARCH}-unknown-linux-gnu/llvm/" /usr/libexec/llvm/
+
 RUN \
   install -p -m 0644 -Dt licenses COPYRIGHT LICENSE-*
 
@@ -349,6 +357,21 @@ ENV PATH="/usr/libexec/rust/bin:$PATH" LD_LIBRARY_PATH="/usr/libexec/rust/lib"
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
+FROM scratch AS sdk-llvm
+
+# Copy the LLVM install directly to `/usr`, so clang can auto-discover the
+# GCC target toolchains.
+COPY --from=sdk-rust /usr/libexec/llvm/ /usr/
+
+# =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
+
+# Merge the LLVM install with the rest of our toolchains and C libraries for
+# later use by the AWS-LC builds.
+FROM sdk-libc AS sdk-libc-llvm
+COPY --from=sdk-llvm / /
+
+# =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
+
 FROM sdk AS sdk-grub
 
 USER root
@@ -474,7 +497,7 @@ RUN \
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
-FROM sdk-libc AS sdk-go-prep
+FROM sdk-libc-llvm AS sdk-go-prep
 
 # Set up the environment for building.
 ENV GOOS="linux"
@@ -953,7 +976,6 @@ USER root
 RUN \
   dnf -y install --setopt=install_weak_deps=False \
     ccache \
-    clang \
     createrepo_c \
     dosfstools \
     e2fsprogs \
@@ -967,6 +989,7 @@ RUN \
     groff \
     kpartx \
     less \
+    libbpf-devel \
     libcap-devel \
     libkcapi-hmaccalc \
     lz4 \
@@ -978,6 +1001,7 @@ RUN \
     protobuf-compiler \
     protobuf-devel \
     python3-devel \
+    python3-pyelftools \
     python3-jinja2 \
     python3-virt-firmware \
     qemu-img \
@@ -1117,12 +1141,15 @@ COPY --from=sdk-libc-musl / /
 # "sdk-libc-gnu" has the GNU C library and headers.
 COPY --from=sdk-libc-gnu / /
 
-# "sdk-rust" has our Rust toolchain with the required targets.
+# "sdk-rust" has our Rust toolchains with the required targets.
 COPY --chown=0:0 --from=sdk-rust /usr/libexec/rust/ /usr/libexec/rust/
 COPY --chown=0:0 --from=sdk-rust \
   /home/builder/rust/licenses/ \
   /usr/share/licenses/rust/
 
+# "sdk-llvm" has our LLVM toolchain.
+COPY --chown=0:0 --from=sdk-llvm / /
+
 # "sdk-go" has the Go toolchain and standard library builds.
 COPY --chown=0:0 --from=sdk-go-1.25 /home/builder/sdk-go/bin /usr/libexec/go-1.25/bin/
 COPY --chown=0:0 --from=sdk-go-1.25 /home/builder/sdk-go/lib /usr/libexec/go-1.25/lib/
diff --git a/configs/rust/config.toml.in b/configs/rust/config.toml.in
index ed075e86..691ec52f 100644
--- a/configs/rust/config.toml.in
+++ b/configs/rust/config.toml.in
@@ -26,7 +26,11 @@ debuginfo-level-std = 2
 rpath = false
 
 [llvm]
+download-ci-llvm = false
 static-libstdcpp = false
+targets = "AArch64;BPF;X86"
+clang = true
+link-shared = true
 
 [install]
 prefix = "/usr/libexec/rust"