diff --git a/tools/base/BUILD b/tools/base/BUILD
index 116924033868..eba567e77fc6 100644
--- a/tools/base/BUILD
+++ b/tools/base/BUILD
@@ -6,6 +6,10 @@ licenses(["notice"])  # Apache 2
 
 envoy_package()
 
+exports_files([
+    "entry_point.py",
+])
+
 py_binary(
     name = "bazel_query",
     srcs = ["bazel_query.py"],
diff --git a/tools/base/entry_point.py b/tools/base/entry_point.py
index 1d9fa10d2fbf..cdd1cf421d43 100644
--- a/tools/base/entry_point.py
+++ b/tools/base/entry_point.py
@@ -1,10 +1,32 @@
+import pathlib
 import subprocess
 import sys
 
+ENTRY_POINT_ALIAS = "_ENTRY_POINT_ALIAS_"
+
+
+def find_tool_path():
+    # In order to work in both build/run scenarios, and to work
+    # when the rule is invoked directly, or by another rule, the
+    # path to the entry_point binary has to be found from the
+    # `ENTRY_POINT_ALIAS` that is injected by the `genrule`
+
+    entry_point_alias = f"external/{ENTRY_POINT_ALIAS.split('/external/')[1]}"
+    if pathlib.Path(entry_point_alias).exists():
+        return entry_point_alias
+    for x in pathlib.Path(".").glob(f"**/{entry_point_alias}"):
+        return x
+
 
 def main(*args) -> int:
+    tool_path = find_tool_path()
+
+    if not tool_path:
+        print(f"Unable to locate tool: {ENTRY_POINT_ALIAS}")
+        return 1
+
     try:
-        return subprocess.run(args).returncode
+        return subprocess.run([tool_path, *args]).returncode
     except KeyboardInterrupt:
         return 1
 
diff --git a/tools/base/envoy_python.bzl b/tools/base/envoy_python.bzl
index d938865b5e0a..a4d8a7797ca7 100644
--- a/tools/base/envoy_python.bzl
+++ b/tools/base/envoy_python.bzl
@@ -80,7 +80,8 @@ def envoy_entry_point(
         entry_point = base_entry_point,
         script = None,
         data = None,
-        args = None):
+        args = None,
+        envoy_prefix = "@envoy"):
     """This macro provides the convenience of using an `entry_point` while
     also being able to create a rule with associated `args` and `data`, as is
     possible with the normal `py_binary` rule.
@@ -97,19 +98,32 @@ def envoy_entry_point(
     A `py_binary` is dynamically created to wrap the `entry_point` with provided
     `args` and `data`.
     """
-    script = script or pkg
-    entry_point_name = "%s_entry_point" % name
-    native.alias(
-        name = entry_point_name,
-        actual = entry_point(
-            pkg = pkg,
-            script = script,
-        ),
+    actual_entry_point = entry_point(
+        pkg = pkg,
+        script = script or pkg,
     )
+    entry_point_script = "%s%s" % (envoy_prefix, main)
+    entry_point_py = "entry_point_%s_main.py" % name
+    entry_point_wrapper = "entry_point_%s_wrapper" % name
+    entry_point_path = "$(location %s)" % entry_point_script
+    entry_point_alias = "$(location %s)" % actual_entry_point
+
+    native.genrule(
+        name = entry_point_wrapper,
+        cmd = """
+        sed s#_ENTRY_POINT_ALIAS_#%s# %s > \"$@\"
+        """ % (entry_point_alias, entry_point_path),
+        tools = [
+            actual_entry_point,
+            entry_point_script,
+        ],
+        outs = [entry_point_py],
+    )
+
     py_binary(
         name = name,
-        srcs = [main],
-        main = main,
-        args = ["$(location %s)" % entry_point_name] + args,
-        data = [entry_point_name] + data,
+        srcs = [entry_point_wrapper, actual_entry_point],
+        main = entry_point_py,
+        args = (args or []),
+        data = (data or []),
     )
diff --git a/tools/distribution/BUILD b/tools/distribution/BUILD
index e00e257bdc4e..f4bea79a2132 100644
--- a/tools/distribution/BUILD
+++ b/tools/distribution/BUILD
@@ -1,5 +1,5 @@
 load("//bazel:envoy_build_system.bzl", "envoy_package")
-load("@base_pip3//:requirements.bzl", "entry_point")
+load("//tools/base:envoy_python.bzl", "envoy_entry_point")
 
 licenses(["notice"])  # Apache 2
 
@@ -9,26 +9,17 @@ exports_files([
     "distrotest.sh",
 ])
 
-alias(
+envoy_entry_point(
     name = "release",
-    actual = entry_point(
-        pkg = "envoy.distribution.release",
-        script = "envoy.distribution.release",
-    ),
+    pkg = "envoy.distribution.release",
 )
 
-alias(
+envoy_entry_point(
     name = "sign",
-    actual = entry_point(
-        pkg = "envoy.gpg.sign",
-        script = "envoy.gpg.sign",
-    ),
+    pkg = "envoy.gpg.sign",
 )
 
-alias(
+envoy_entry_point(
     name = "verify",
-    actual = entry_point(
-        pkg = "envoy.distribution.verify",
-        script = "envoy.distribution.verify",
-    ),
+    pkg = "envoy.distribution.verify",
 )
diff --git a/tools/docs/BUILD b/tools/docs/BUILD
index c26d07524b79..cbe35c48187d 100644
--- a/tools/docs/BUILD
+++ b/tools/docs/BUILD
@@ -1,7 +1,7 @@
 load("@rules_python//python:defs.bzl", "py_binary")
-load("@base_pip3//:requirements.bzl", "entry_point", "requirement")
+load("@base_pip3//:requirements.bzl", "requirement")
+load("//tools/base:envoy_python.bzl", "envoy_entry_point", "envoy_py_binary")
 load("//bazel:envoy_build_system.bzl", "envoy_package")
-load("//tools/base:envoy_python.bzl", "envoy_py_binary")
 
 licenses(["notice"])  # Apache 2
 
@@ -40,12 +40,9 @@ py_binary(
 #
 #    https://github.com/envoyproxy/pytooling
 
-alias(
+envoy_entry_point(
     name = "sphinx_runner",
-    actual = entry_point(
-        pkg = "envoy.docs.sphinx_runner",
-        script = "envoy.docs.sphinx_runner",
-    ),
+    pkg = "envoy.docs.sphinx_runner",
 )
 
 envoy_py_binary(