diff --git a/nixpkgs/BUILD.bazel b/nixpkgs/BUILD.bazel
index 8aedcbe72..ab0bf9bca 100644
--- a/nixpkgs/BUILD.bazel
+++ b/nixpkgs/BUILD.bazel
@@ -44,6 +44,7 @@ bzl_library(
         "@rules_nixpkgs_cc//:cc.bzl",
         "@rules_nixpkgs_java//:java.bzl",
         "@rules_nixpkgs_python//:python.bzl",
+        "@rules_nixpkgs_posix//:posix.bzl",
         ":bazel_tools",
         "@bazel_skylib//lib:new_sets",
         "@bazel_skylib//lib:paths",
diff --git a/nixpkgs/nixpkgs.bzl b/nixpkgs/nixpkgs.bzl
index 6fadcf584..e66c60e8c 100644
--- a/nixpkgs/nixpkgs.bzl
+++ b/nixpkgs/nixpkgs.bzl
@@ -29,6 +29,10 @@ load(
     "@rules_nixpkgs_cc//:cc.bzl",
     _nixpkgs_cc_configure = "nixpkgs_cc_configure",
 )
+load(
+    "@rules_nixpkgs_posix//:posix.bzl",
+    _nixpkgs_sh_posix_configure = "nixpkgs_sh_posix_configure",
+)
 
 # aliases for backwards compatibility prior to `bzlmod`
 nixpkgs_git_repository = _nixpkgs_git_repository
@@ -37,6 +41,7 @@ nixpkgs_package = _nixpkgs_package
 nixpkgs_python_configure = _nixpkgs_python_configure
 nixpkgs_java_configure = _nixpkgs_java_configure
 nixpkgs_cc_configure = _nixpkgs_cc_configure
+nixpkgs_sh_posix_configure = _nixpkgs_sh_posix_configure
 
 def nixpkgs_cc_autoconf_impl(repository_ctx):
     cpu_value = get_cpu_value(repository_ctx)
@@ -178,155 +183,3 @@ def nixpkgs_cc_configure_deprecated(
     nixpkgs_cc_autoconf(name = "local_config_cc")
     native.bind(name = "cc_toolchain", actual = "@local_config_cc//:toolchain")
     native.register_toolchains("@local_config_cc//:all")
-
-def nixpkgs_sh_posix_config(name, packages, **kwargs):
-    nixpkgs_package(
-        name = name,
-        nix_file_content = """
-with import <nixpkgs> {{ config = {{}}; overlays = []; }};
-
-let
-  # `packages` might include lists, e.g. `stdenv.initialPath` is a list itself,
-  # so we need to flatten `packages`.
-  flatten = builtins.concatMap (x: if builtins.isList x then x else [x]);
-  env = buildEnv {{
-    name = "posix-toolchain";
-    paths = flatten [ {} ];
-  }};
-  cmd_glob = "${{env}}/bin/*";
-  os = if stdenv.isDarwin then "osx" else "linux";
-in
-
-runCommand "bazel-nixpkgs-posix-toolchain"
-  {{ executable = false;
-    # Pointless to do this on a remote machine.
-    preferLocalBuild = true;
-    allowSubstitutes = false;
-  }}
-  ''
-    n=$out/nixpkgs_sh_posix.bzl
-    mkdir -p "$(dirname "$n")"
-
-    cat >>$n <<EOF
-    load("@rules_sh//sh:posix.bzl", "posix", "sh_posix_toolchain")
-    discovered = {{
-    EOF
-    for cmd in ${{cmd_glob}}; do
-        if [[ -x $cmd ]]; then
-            echo "    '$(basename $cmd)': '$cmd'," >>$n
-        fi
-    done
-    cat >>$n <<EOF
-    }}
-    def create_posix_toolchain():
-        sh_posix_toolchain(
-            name = "nixpkgs_sh_posix",
-            cmds = {{
-                cmd: discovered[cmd]
-                for cmd in posix.commands
-                if cmd in discovered
-            }}
-        )
-    EOF
-  ''
-""".format(" ".join(packages)),
-        build_file_content = """
-load("//:nixpkgs_sh_posix.bzl", "create_posix_toolchain")
-create_posix_toolchain()
-""",
-        **kwargs
-    )
-
-# Note [Target constraints for POSIX tools]
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-# There at least three cases for POSIX tools.
-#
-# Case 1) The tools are used at build time in the execution platform.
-#
-# Case 2) The tools are used at runtime time in the target platform
-#         when the target platform is the same as the execution
-#         platform.
-#
-# Case 3) The tools are used at runtime time in the target platform
-#         when cross-compiling.
-#
-# At the moment, only (1) and (2) are supported by ignoring any target
-# constraints when defining the toolchain. This makes available
-# any tools that don't depend on the target platform like grep, find
-# or sort. In case (2), the tools are still usable at runtime since
-# the platforms match.
-#
-# POSIX tools that depend on the target platform, like cc and strip,
-# are better taken from the Bazel cc toolchain instead, so they do
-# match the target platform.
-#
-# TODO: In order to support (3), where the tools would be needed at
-# runtime, nixpkgs_sh_posix_configure will need to be changed to take
-# as parameter the constraints for the platform in which the tools
-# should run.
-
-def _nixpkgs_sh_posix_toolchain_impl(repository_ctx):
-    cpu = get_cpu_value(repository_ctx)
-    repository_ctx.file("BUILD", executable = False, content = """
-toolchain(
-    name = "nixpkgs_sh_posix_toolchain",
-    toolchain = "@{workspace}//:nixpkgs_sh_posix",
-    toolchain_type = "@rules_sh//sh/posix:toolchain_type",
-    exec_compatible_with = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:{os}",
-        "@io_tweag_rules_nixpkgs//nixpkgs/constraints:support_nix",
-    ],
-    # Leaving the target constraints empty matter for cross-compilation.
-    # See Note [Target constraints for POSIX tools]
-    target_compatible_with = [],
-)
-    """.format(
-        workspace = repository_ctx.attr.workspace,
-        os = {"darwin": "osx"}.get(cpu, "linux"),
-    ))
-
-_nixpkgs_sh_posix_toolchain = repository_rule(
-    _nixpkgs_sh_posix_toolchain_impl,
-    attrs = {
-        "workspace": attr.string(),
-    },
-)
-
-def nixpkgs_sh_posix_configure(
-        name = "nixpkgs_sh_posix_config",
-        packages = ["stdenv.initialPath"],
-        **kwargs):
-    """Create a POSIX toolchain from nixpkgs.
-
-    Loads the given Nix packages, scans them for standard Unix tools, and
-    generates a corresponding `sh_posix_toolchain`.
-
-    Make sure to call `nixpkgs_sh_posix_configure` before `sh_posix_configure`,
-    if you use both. Otherwise, the local toolchain will always be chosen in
-    favor of the nixpkgs one.
-
-    Args:
-      name: Name prefix for the generated repositories.
-      packages: List of Nix attribute paths to draw Unix tools from.
-      nix_file_deps: See nixpkgs_package.
-      repositories: See nixpkgs_package.
-      repository: See nixpkgs_package.
-      nixopts: See nixpkgs_package.
-      fail_not_supported: See nixpkgs_package.
-    """
-    nixpkgs_sh_posix_config(
-        name = name,
-        packages = packages,
-        **kwargs
-    )
-
-    # The indirection is required to avoid errors when `nix-build` is not in `PATH`.
-    _nixpkgs_sh_posix_toolchain(
-        name = name + "_toolchain",
-        workspace = name,
-    )
-    native.register_toolchains(
-        "@{}//:nixpkgs_sh_posix_toolchain".format(name + "_toolchain"),
-    )
diff --git a/nixpkgs/repositories.bzl b/nixpkgs/repositories.bzl
index d00819a17..319f5f8ca 100644
--- a/nixpkgs/repositories.bzl
+++ b/nixpkgs/repositories.bzl
@@ -40,6 +40,7 @@ def rules_nixpkgs_dependencies(local = None):
         ("rules_nixpkgs_cc", "toolchains/cc"),
         ("rules_nixpkgs_java", "toolchains/java"),
         ("rules_nixpkgs_python", "toolchains/python"),
+        ("rules_nixpkgs_posix", "toolchains/posix"),
     ]:
         if not local:
             # XXX: no way to use `sha256` here, but if this surrounding repo comes
diff --git a/tests/BUILD.bazel b/tests/BUILD.bazel
index beda66f4d..b982bfbbd 100644
--- a/tests/BUILD.bazel
+++ b/tests/BUILD.bazel
@@ -146,6 +146,7 @@ sh_test(
         "@rules_nixpkgs_cc//:srcs",
         "@rules_nixpkgs_java//:srcs",
         "@rules_nixpkgs_python//:srcs",
+        "@rules_nixpkgs_posix//:srcs",
         "@nix-unstable//:bin",
     ] + select({
         "@platforms//os:linux": ["@busybox_static//:bin"],
diff --git a/tests/invalid_nixpkgs_package/workspace.bazel b/tests/invalid_nixpkgs_package/workspace.bazel
index a6aa7aa5e..9dd909b79 100644
--- a/tests/invalid_nixpkgs_package/workspace.bazel
+++ b/tests/invalid_nixpkgs_package/workspace.bazel
@@ -13,6 +13,7 @@ load("//nixpkgs:repositories.bzl", "rules_nixpkgs_dependencies")
     "rules_nixpkgs_cc",
     "rules_nixpkgs_java",
     "rules_nixpkgs_python",
+    "rules_nixpkgs_posix",
 ]]
 
 rules_nixpkgs_dependencies()
diff --git a/toolchains/posix/BUILD.bazel b/toolchains/posix/BUILD.bazel
new file mode 100644
index 000000000..a6c9e01ee
--- /dev/null
+++ b/toolchains/posix/BUILD.bazel
@@ -0,0 +1,11 @@
+package(default_visibility = ["//visibility:public"])
+
+exports_files([
+    "posix.bzl",
+])
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)
diff --git a/toolchains/posix/MODULE.bazel b/toolchains/posix/MODULE.bazel
new file mode 100644
index 000000000..bf7d111aa
--- /dev/null
+++ b/toolchains/posix/MODULE.bazel
@@ -0,0 +1,7 @@
+module(
+    name = "rules_nixpkgs_posix",
+    version = "0.8.1",
+)
+
+bazel_dep(name = "rules_nixpkgs_core", version = "0.8.1")
+bazel_dep(name = "rules_sh", version = "0.2.0")
diff --git a/toolchains/posix/WORKSPACE b/toolchains/posix/WORKSPACE
new file mode 100644
index 000000000..2bda73373
--- /dev/null
+++ b/toolchains/posix/WORKSPACE
@@ -0,0 +1,2 @@
+# only temporary for compatibility with `WORKSPACE` setup
+# TODO: remove when migration to `bzlmod` is complete
diff --git a/toolchains/posix/posix.bzl b/toolchains/posix/posix.bzl
new file mode 100644
index 000000000..e3e124ca6
--- /dev/null
+++ b/toolchains/posix/posix.bzl
@@ -0,0 +1,157 @@
+load(
+    "@bazel_tools//tools/cpp:lib_cc_configure.bzl",
+    "get_cpu_value",
+)
+load("@rules_nixpkgs_core//:nixpkgs.bzl", "nixpkgs_package")
+
+def nixpkgs_sh_posix_config(name, packages, **kwargs):
+    nixpkgs_package(
+        name = name,
+        nix_file_content = """
+with import <nixpkgs> {{ config = {{}}; overlays = []; }};
+
+let
+  # `packages` might include lists, e.g. `stdenv.initialPath` is a list itself,
+  # so we need to flatten `packages`.
+  flatten = builtins.concatMap (x: if builtins.isList x then x else [x]);
+  env = buildEnv {{
+    name = "posix-toolchain";
+    paths = flatten [ {} ];
+  }};
+  cmd_glob = "${{env}}/bin/*";
+  os = if stdenv.isDarwin then "osx" else "linux";
+in
+
+runCommand "bazel-nixpkgs-posix-toolchain"
+  {{ executable = false;
+    # Pointless to do this on a remote machine.
+    preferLocalBuild = true;
+    allowSubstitutes = false;
+  }}
+  ''
+    n=$out/nixpkgs_sh_posix.bzl
+    mkdir -p "$(dirname "$n")"
+
+    cat >>$n <<EOF
+    load("@rules_sh//sh:posix.bzl", "posix", "sh_posix_toolchain")
+    discovered = {{
+    EOF
+    for cmd in ${{cmd_glob}}; do
+        if [[ -x $cmd ]]; then
+            echo "    '$(basename $cmd)': '$cmd'," >>$n
+        fi
+    done
+    cat >>$n <<EOF
+    }}
+    def create_posix_toolchain():
+        sh_posix_toolchain(
+            name = "nixpkgs_sh_posix",
+            cmds = {{
+                cmd: discovered[cmd]
+                for cmd in posix.commands
+                if cmd in discovered
+            }}
+        )
+    EOF
+  ''
+""".format(" ".join(packages)),
+        build_file_content = """
+load("//:nixpkgs_sh_posix.bzl", "create_posix_toolchain")
+create_posix_toolchain()
+""",
+        **kwargs
+    )
+
+# Note [Target constraints for POSIX tools]
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# There at least three cases for POSIX tools.
+#
+# Case 1) The tools are used at build time in the execution platform.
+#
+# Case 2) The tools are used at runtime time in the target platform
+#         when the target platform is the same as the execution
+#         platform.
+#
+# Case 3) The tools are used at runtime time in the target platform
+#         when cross-compiling.
+#
+# At the moment, only (1) and (2) are supported by ignoring any target
+# constraints when defining the toolchain. This makes available
+# any tools that don't depend on the target platform like grep, find
+# or sort. In case (2), the tools are still usable at runtime since
+# the platforms match.
+#
+# POSIX tools that depend on the target platform, like cc and strip,
+# are better taken from the Bazel cc toolchain instead, so they do
+# match the target platform.
+#
+# TODO: In order to support (3), where the tools would be needed at
+# runtime, nixpkgs_sh_posix_configure will need to be changed to take
+# as parameter the constraints for the platform in which the tools
+# should run.
+
+def _nixpkgs_sh_posix_toolchain_impl(repository_ctx):
+    cpu = get_cpu_value(repository_ctx)
+    repository_ctx.file("BUILD", executable = False, content = """
+toolchain(
+    name = "nixpkgs_sh_posix_toolchain",
+    toolchain = "@{workspace}//:nixpkgs_sh_posix",
+    toolchain_type = "@rules_sh//sh/posix:toolchain_type",
+    exec_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:{os}",
+        "@rules_nixpkgs_core//constraints:support_nix",
+    ],
+    # Leaving the target constraints empty matter for cross-compilation.
+    # See Note [Target constraints for POSIX tools]
+    target_compatible_with = [],
+)
+    """.format(
+        workspace = repository_ctx.attr.workspace,
+        os = {"darwin": "osx"}.get(cpu, "linux"),
+    ))
+
+_nixpkgs_sh_posix_toolchain = repository_rule(
+    _nixpkgs_sh_posix_toolchain_impl,
+    attrs = {
+        "workspace": attr.string(),
+    },
+)
+
+def nixpkgs_sh_posix_configure(
+        name = "nixpkgs_sh_posix_config",
+        packages = ["stdenv.initialPath"],
+        **kwargs):
+    """Create a POSIX toolchain from nixpkgs.
+
+    Loads the given Nix packages, scans them for standard Unix tools, and
+    generates a corresponding `sh_posix_toolchain`.
+
+    Make sure to call `nixpkgs_sh_posix_configure` before `sh_posix_configure`,
+    if you use both. Otherwise, the local toolchain will always be chosen in
+    favor of the nixpkgs one.
+
+    Args:
+      name: Name prefix for the generated repositories.
+      packages: List of Nix attribute paths to draw Unix tools from.
+      nix_file_deps: See nixpkgs_package.
+      repositories: See nixpkgs_package.
+      repository: See nixpkgs_package.
+      nixopts: See nixpkgs_package.
+      fail_not_supported: See nixpkgs_package.
+    """
+    nixpkgs_sh_posix_config(
+        name = name,
+        packages = packages,
+        **kwargs
+    )
+
+    # The indirection is required to avoid errors when `nix-build` is not in `PATH`.
+    _nixpkgs_sh_posix_toolchain(
+        name = name + "_toolchain",
+        workspace = name,
+    )
+    native.register_toolchains(
+        "@{}//:nixpkgs_sh_posix_toolchain".format(name + "_toolchain"),
+    )