diff --git a/MODULE.bazel b/MODULE.bazel
index cd3042b055..e14d091766 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -288,12 +288,9 @@ http_archive(
     build_file_content = """\
 package(default_visibility = ["//visibility:public"])
 
-genrule(
+filegroup(
     name = "ninja_bin",
     srcs = ["ninja"],
-    outs = ["ninja.exec"],
-    cmd = "cp $< $@ && chmod +x $@",
-    executable = True,
 )
 """,
 )
@@ -308,12 +305,9 @@ http_archive(
     build_file_content = """\
 package(default_visibility = ["//visibility:public"])
 
-genrule(
+filegroup(
     name = "ninja_bin",
     srcs = ["ninja"],
-    outs = ["ninja.exec"],
-    cmd = "cp $< $@ && chmod +x $@",
-    executable = True,
 )
 """,
 )
@@ -426,6 +420,7 @@ bazel_dep(name = "meson", version = "1.5.1.bcr.1")
 crate.annotation(
     build_script_tools = [
         "@meson//:meson",
+        "@@//tools/ninja_wrapper:ninja_wrapper.sh",
         "@ninja_1.11.0_linux//:ninja_bin",
         "@ninja_1.11.0_mac//:ninja_bin",
         "@ninja_1.11.0_win//:ninja_bin",
@@ -434,12 +429,12 @@ crate.annotation(
         "MESON": "$(execpath @meson//:meson)",
     },
     build_script_env_select = {
-        "aarch64-apple-darwin": "{\"NINJA\":\"$(execpath @ninja_1.11.0_mac//:ninja_bin)\"}",
-        "x86_64-apple-darwin": "{\"NINJA\":\"$(execpath @ninja_1.11.0_mac//:ninja_bin)\"}",
-        "aarch64-unknown-linux-gnu": "{\"NINJA\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
-        "x86_64-unknown-linux-gnu": "{\"NINJA\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
-        "aarch64-unknown-linux-musl": "{\"NINJA\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
-        "x86_64-unknown-linux-musl": "{\"NINJA\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
+        "aarch64-apple-darwin": "{\"NINJA\":\"$(execpath @@//tools/ninja_wrapper:ninja_wrapper.sh)\",\"NINJA_REAL\":\"$(execpath @ninja_1.11.0_mac//:ninja_bin)\"}",
+        "x86_64-apple-darwin": "{\"NINJA\":\"$(execpath @@//tools/ninja_wrapper:ninja_wrapper.sh)\",\"NINJA_REAL\":\"$(execpath @ninja_1.11.0_mac//:ninja_bin)\"}",
+        "aarch64-unknown-linux-gnu": "{\"NINJA\":\"$(execpath @@//tools/ninja_wrapper:ninja_wrapper.sh)\",\"NINJA_REAL\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
+        "x86_64-unknown-linux-gnu": "{\"NINJA\":\"$(execpath @@//tools/ninja_wrapper:ninja_wrapper.sh)\",\"NINJA_REAL\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
+        "aarch64-unknown-linux-musl": "{\"NINJA\":\"$(execpath @@//tools/ninja_wrapper:ninja_wrapper.sh)\",\"NINJA_REAL\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
+        "x86_64-unknown-linux-musl": "{\"NINJA\":\"$(execpath @@//tools/ninja_wrapper:ninja_wrapper.sh)\",\"NINJA_REAL\":\"$(execpath @ninja_1.11.0_linux//:ninja_bin)\"}",
         "aarch64-pc-windows-msvc": "{\"NINJA\":\"$(execpath @ninja_1.11.0_win//:ninja_bin)\"}",
         "x86_64-pc-windows-msvc": "{\"NINJA\":\"$(execpath @ninja_1.11.0_win//:ninja_bin)\"}",
         "aarch64-pc-windows-gnullvm": "{\"NINJA\":\"$(execpath @ninja_1.11.0_win//:ninja_bin)\"}",
diff --git a/tools/ninja_wrapper/BUILD.bazel b/tools/ninja_wrapper/BUILD.bazel
new file mode 100644
index 0000000000..c53df6ef70
--- /dev/null
+++ b/tools/ninja_wrapper/BUILD.bazel
@@ -0,0 +1,4 @@
+exports_files(
+    ["ninja_wrapper.sh"],
+    visibility = ["//visibility:public"],
+)
diff --git a/tools/ninja_wrapper/ninja_wrapper.sh b/tools/ninja_wrapper/ninja_wrapper.sh
new file mode 100755
index 0000000000..20d1b2be00
--- /dev/null
+++ b/tools/ninja_wrapper/ninja_wrapper.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+set -eu
+
+real_ninja="${NINJA_REAL:?NINJA_REAL must point to the downloaded ninja binary}"
+staged_ninja="${TMPDIR:-/tmp}/codex-ninja-$$"
+
+cp "${real_ninja}" "${staged_ninja}"
+chmod +x "${staged_ninja}"
+trap 'rm -f "${staged_ninja}"' EXIT
+
+exec "${staged_ninja}" "$@"