diff --git a/bazel/foreign_cc/hyperscan.patch b/bazel/foreign_cc/hyperscan.patch
index 52775d4431bd8..45e53efcdc550 100644
--- a/bazel/foreign_cc/hyperscan.patch
+++ b/bazel/foreign_cc/hyperscan.patch
@@ -80,7 +80,7 @@ index 895610c..6be61fd 100755
  PREFIX=$1
  KEEPSYMS_IN=$2
  shift 2
-+
++set -e
 +if [ -n "$EXT_BUILD_ROOT" ]; then
 +    if [ -n "$NM" ]; then
 +        case "$NM" in
diff --git a/contrib/hyperscan/matching/input_matchers/source/BUILD b/contrib/hyperscan/matching/input_matchers/source/BUILD
index 6d633ad268e25..22c757d90abcb 100644
--- a/contrib/hyperscan/matching/input_matchers/source/BUILD
+++ b/contrib/hyperscan/matching/input_matchers/source/BUILD
@@ -34,10 +34,19 @@ envoy_cmake(
         "PYTHON_EXECUTABLE": "$(PYTHON3)",
     },
     default_cache_entries = {},
-    env = {
-        "NM": "$$EXT_BUILD_ROOT/$(NM)",
-        "OBJCOPY": "$$EXT_BUILD_ROOT/$(OBJCOPY)",
-    },
+    env = select({
+        # When using non-hermetic LLVM toolchain the paths to objcopy and nm will point
+        # to the host objcopy and nm, so there is no need to prefix those with the path
+        # to the directory with external dependencies.
+        "@envoy_repo//:use_local_llvm": {
+            "NM": "$(NM)",
+            "OBJCOPY": "$(OBJCOPY)",
+        },
+        "//conditions:default": {
+            "NM": "$$EXT_BUILD_ROOT/$(NM)",
+            "OBJCOPY": "$$EXT_BUILD_ROOT/$(OBJCOPY)",
+        },
+    }),
     exec_properties = select({
         "//bazel:engflow_rbe_x86_64": {
             "Pool": "linux_x64_xlarge",