diff --git a/.bazelrc b/.bazelrc
index 178245be2..6d97b9aab 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -57,7 +57,9 @@ test:remote --remote_timeout=3600
 test:remote --keep_going
 
 # Configuration specific to buildkite CI testing the default workspace
-test:buildkite --action_env=PATH 
-test:buildkite --define=ENV_KEY=my_key # for tests/container:set_env_make_vars_test 
-test:buildkite --define=ENV_VALUE=my_value # for tests/container:set_env_make_vars_test 
+test:buildkite --action_env=PATH
 test:buildkite --test_output=errors
+
+# A test verifies that these values can be expanded as make vars
+test --define=ENV_KEY=my_key # for tests/container:set_env_make_vars_test
+test --define=ENV_VALUE=my_value # for tests/container:set_env_make_vars_test
diff --git a/container/image.bzl b/container/image.bzl
index 790409a7e..bbf6f697e 100644
--- a/container/image.bzl
+++ b/container/image.bzl
@@ -550,8 +550,12 @@ def _impl(
         command = "cp %s %s" % (config_digest.path, output_config_digest.path),
     )
 
+    toolchain_info = ctx.toolchains["@io_bazel_rules_docker//toolchains/docker:toolchain_type"].info
+    runfiles_files = [config_file, config_digest, output_config_digest]
+    if toolchain_info.tool_target:
+        runfiles_files.append(toolchain_info.tool_target.files_to_run.executable)
     runfiles = ctx.runfiles(
-        files = unzipped_layers + diff_ids + [config_file, config_digest, output_config_digest] +
+        files = unzipped_layers + diff_ids + runfiles_files +
                 ([container_parts["legacy"]] if container_parts["legacy"] else []),
     )
 
diff --git a/container/incremental_load.sh.tpl b/container/incremental_load.sh.tpl
index b0e0157c8..2ed009fa4 100644
--- a/container/incremental_load.sh.tpl
+++ b/container/incremental_load.sh.tpl
@@ -31,9 +31,8 @@ function guess_runfiles() {
 
 RUNFILES="${PYTHON_RUNFILES:-$(guess_runfiles)}"
 
-DOCKER="%{docker_tool_path}"
+DOCKER="$(readlink -nf %{docker_tool_path})"
 DOCKER_FLAGS="%{docker_flags}"
-
 if [[ -z "${DOCKER}" ]]; then
     echo >&2 "error: docker not found; do you need to manually configure the docker toolchain?"
     exit 1
diff --git a/toolchains/docker/toolchain.bzl b/toolchains/docker/toolchain.bzl
index a7bbf9441..16f20d0f9 100644
--- a/toolchains/docker/toolchain.bzl
+++ b/toolchains/docker/toolchain.bzl
@@ -126,7 +126,7 @@ def _toolchain_configure_impl(repository_ctx):
 
     tool_attr = ""
     if repository_ctx.attr.docker_target:
-        tool_attr = "tool_target = \"%s\"," % repository_ctx.attr.tool_target
+        tool_attr = "tool_target = \"%s\"," % repository_ctx.attr.docker_target
     elif repository_ctx.attr.docker_path:
         tool_attr = "tool_path = \"%s\"," % repository_ctx.attr.docker_path
     elif repository_ctx.which("docker"):