diff --git a/modules/sq/1.4.0.envoy/MODULE.bazel b/modules/sq/1.4.0.envoy/MODULE.bazel
index cff13c5..5f39aa2 100644
--- a/modules/sq/1.4.0.envoy/MODULE.bazel
+++ b/modules/sq/1.4.0.envoy/MODULE.bazel
@@ -30,3 +30,5 @@ crate.from_cargo(
     manifests = ["//:Cargo.toml"],
 )
 use_repo(crate, "sequoia_sq_crate_index")
+
+register_toolchains("//toolchains:from_source")
diff --git a/modules/sq/1.4.0.envoy/overlay/BUILD.bazel b/modules/sq/1.4.0.envoy/overlay/BUILD.bazel
index f70b4d9..fb631d0 100644
--- a/modules/sq/1.4.0.envoy/overlay/BUILD.bazel
+++ b/modules/sq/1.4.0.envoy/overlay/BUILD.bazel
@@ -1,10 +1,13 @@
 load("@rules_rust//rust:defs.bzl", "rust_binary")
 load("@sequoia_sq_crate_index//:defs.bzl", "aliases", "all_crate_deps")
+load("//:defs.bzl", "current_sq_toolchain")
 
 package(default_visibility = ["//visibility:public"])
 
+toolchain_type(name = "toolchain_type")
+
 rust_binary(
-    name = "sq",
+    name = "sq_from_source",
     srcs = glob(["src/**/*.rs"]),
     aliases = aliases(),
     compile_data = ["README.md"],
@@ -18,3 +21,5 @@ rust_binary(
     proc_macro_deps = all_crate_deps(proc_macro = True),
     deps = all_crate_deps(normal = True),
 )
+
+current_sq_toolchain(name = "sq")
diff --git a/modules/sq/1.4.0.envoy/overlay/MODULE.bazel b/modules/sq/1.4.0.envoy/overlay/MODULE.bazel
new file mode 100644
index 0000000..5f39aa2
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/overlay/MODULE.bazel
@@ -0,0 +1,34 @@
+module(
+    name = "sq",
+    version = "1.4.0.envoy",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "rules_rust", version = "0.69.0.envoy")
+
+rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
+rust.toolchain(
+    edition = "2021",
+    versions = ["1.85.0"],
+)
+use_repo(rust, "rust_toolchains")
+register_toolchains("@rust_toolchains//:all")
+
+crate = use_extension("@rules_rust//crate_universe:extensions.bzl", "crate")
+crate.annotation(
+    crate = "sequoia-openpgp",
+    crate_features = [
+        "crypto-rust",
+        "allow-experimental-crypto",
+        "allow-variable-time-crypto",
+    ],
+)
+crate.from_cargo(
+    name = "sequoia_sq_crate_index",
+    cargo_lockfile = "//:Cargo.lock",
+    manifests = ["//:Cargo.toml"],
+)
+use_repo(crate, "sequoia_sq_crate_index")
+
+register_toolchains("//toolchains:from_source")
diff --git a/modules/sq/1.4.0.envoy/overlay/defs.bzl b/modules/sq/1.4.0.envoy/overlay/defs.bzl
new file mode 100644
index 0000000..35a9af0
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/overlay/defs.bzl
@@ -0,0 +1,41 @@
+SqInfo = provider(fields = ["sq", "runfiles"])
+
+
+def _sq_toolchain_impl(ctx):
+    runfiles = ctx.runfiles(files = [ctx.file.sq])
+    return [
+        platform_common.ToolchainInfo(
+            sq_info = SqInfo(sq = ctx.file.sq, runfiles = runfiles),
+        ),
+    ]
+
+
+sq_toolchain = rule(
+    implementation = _sq_toolchain_impl,
+    attrs = {
+        "sq": attr.label(
+            allow_single_file = True,
+            cfg = "exec",
+            executable = True,
+            mandatory = True,
+        ),
+    },
+)
+
+
+def _current_sq_toolchain_impl(ctx):
+    info = ctx.toolchains["//:toolchain_type"].sq_info
+    return [
+        DefaultInfo(
+            executable = info.sq,
+            files = depset([info.sq]),
+            runfiles = info.runfiles,
+        ),
+    ]
+
+
+current_sq_toolchain = rule(
+    implementation = _current_sq_toolchain_impl,
+    executable = True,
+    toolchains = ["//:toolchain_type"],
+)
diff --git a/modules/sq/1.4.0.envoy/overlay/toolchains/BUILD.bazel b/modules/sq/1.4.0.envoy/overlay/toolchains/BUILD.bazel
new file mode 100644
index 0000000..f8c56a8
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/overlay/toolchains/BUILD.bazel
@@ -0,0 +1,14 @@
+load("//:defs.bzl", "sq_toolchain")
+
+package(default_visibility = ["//visibility:public"])
+
+sq_toolchain(
+    name = "from_source_impl",
+    sq = "//:sq_from_source",
+)
+
+toolchain(
+    name = "from_source",
+    toolchain = ":from_source_impl",
+    toolchain_type = "//:toolchain_type",
+)
diff --git a/modules/sq/1.4.0.envoy/private/versions.bzl b/modules/sq/1.4.0.envoy/private/versions.bzl
new file mode 100644
index 0000000..e2d64d6
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/private/versions.bzl
@@ -0,0 +1,3 @@
+SQ_VERSIONS = {
+    "1.4.0": {},
+}
diff --git a/modules/sq/1.4.0.envoy/source.json b/modules/sq/1.4.0.envoy/source.json
index 922d00f..e2b5fb4 100644
--- a/modules/sq/1.4.0.envoy/source.json
+++ b/modules/sq/1.4.0.envoy/source.json
@@ -7,6 +7,9 @@
     "sq-default-crypto-rust.patch": "sha256-HDXDp3D8mE8QmN00Cra6HG4Dz6/DyEEIe83fgIYqk5g="
   },
   "overlay": {
-    "BUILD.bazel": "sha256-Z9gyfFWekCqZ6/GuCTtVcDIgtpHoE9UQISHjI4qX3s8="
+    "BUILD.bazel": "sha256-0LkS+HXmh0/XzAR/uURbMwlplajRFpQUx6feP3tmwcQ=",
+    "MODULE.bazel": "sha256-f8wONEWHbfBCWXqPjSLu+/zYaVaThLeqJLNaCIrRGrE=",
+    "defs.bzl": "sha256-W0mVOA2QWL/uKfkVqXr0NPRdz6fa3QCj3CzvEwfO+Ck=",
+    "toolchains/BUILD.bazel": "sha256-1Wp7UJDPlwvmxalkc8ugxCUlAOyxFb7cyPJFosKysFc="
   }
 }