diff --git a/.bazelrc b/.bazelrc
index 3885564cfd3aa8..51b95ece463000 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -36,3 +36,5 @@ build --tool_java_language_version=11
 
 # User-specific .bazelrc
 try-import user.bazelrc
+
+build --java_runtime_version=remote_jdk11
diff --git a/BUILD b/BUILD
index fea17f077a5726..4bf625c42ebf6c 100644
--- a/BUILD
+++ b/BUILD
@@ -247,3 +247,13 @@ REMOTE_PLATFORMS = ("rbe_ubuntu1804_java11",)
     )
     for platform_name in REMOTE_PLATFORMS
 ]
+
+toolchain(
+    name = "java_toolchain",
+    exec_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    toolchain = "@bazel_tools//tools/jdk:remotejdk11_linux",
+    toolchain_type = "@bazel_tools//tools/jdk:runtime_toolchain_type",
+)
diff --git a/WORKSPACE b/WORKSPACE
index c7fa7f861cdaae..796efeb443cdc9 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -664,3 +664,7 @@ debian_deps()
 load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
 
 bazel_skylib_workspace()
+
+register_toolchains(
+    "//:java_toolchain",
+)
\ No newline at end of file
diff --git a/site/en/docs/coverage.md b/site/en/docs/coverage.md
index 3c75cb8945f087..cf2f4bfff36672 100644
--- a/site/en/docs/coverage.md
+++ b/site/en/docs/coverage.md
@@ -189,16 +189,59 @@ py_test(
 )
 ```
 
-If you are using a hermetic python toolchain, you can instead simply add
+If you are using a hermetic python toolchain, instead of adding an attribute to
+every `py_test` rule you can instead add the coverage tool to the toolchain
+configuration.
+
+Because the `pip_install` rule depends on the python toolchain, you cannot use
+it to fetch the `coverage` module.  Instead, add in your `WORKSPACE` e.g.
 
 ```starlark
-    coverage_tool = ":coverage",
+http_archive(
+    name = "coverage_linux_x86_64"",
+    build_file_content = """
+filegroup(
+    name = "coverage",
+    srcs = ["coverage/__main__.py"],
+    data = glob(["coverage/*", "coverage/**/*.py"]),
+    visibility = ["//visibility:public"],
+)
+""",
+    sha256 = "84631e81dd053e8a0d4967cedab6db94345f1c36107c71698f746cb2636c63e3",
+    type = "zip",
+    urls = [
+        "https://files.pythonhosted.org/packages/74/0d/0f3c522312fd27c32e1abe2fb5c323b583a5c108daf2c26d6e8dfdd5a105/coverage-6.4.1-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
+    ],
+)
 ```
 
-to your `py_runtime` target.  This ensures that coverage is available for all
-`py_test` and `py_binary` targets, and prevents those targets from incurring a
-dependency on `coverage` except when building with coverage enabled.
+Then configure your python toolchain as e.g.
 
+```starlark
+py_runtime(
+    name = "py3_runtime_linux_x86_64",
+    coverage_tool = "@coverage_linux_x86_64//:coverage",
+    files = ["@python3_9_x86_64-unknown-linux-gnu//:files"],
+    interpreter = "@python3_9_x86_64-unknown-linux-gnu//:bin/python3",
+    python_version = "PY3",
+)
+
+py_runtime_pair(
+    name = "python_runtimes_linux_x86_64",
+    py2_runtime = None,
+    py3_runtime = ":py3_runtime_linux_x86_64",
+)
+
+toolchain(
+    name = "python_toolchain_linux_x86_64",
+    exec_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    toolchain = ":python_runtimes_linux_x86_64",
+    toolchain_type = "@bazel_tools//tools/python:toolchain_type",
+)
+```
 
 [lcov]: https://github.com/linux-test-project/lcov
 [rules_python]: https://github.com/bazelbuild/rules_python
diff --git a/src/test/shell/bazel/bazel_coverage_hermetic_py_test.sh b/src/test/shell/bazel/bazel_coverage_hermetic_py_test.sh
index 8ec01a19f3d741..38a299f8eb02b3 100755
--- a/src/test/shell/bazel/bazel_coverage_hermetic_py_test.sh
+++ b/src/test/shell/bazel/bazel_coverage_hermetic_py_test.sh
@@ -44,7 +44,7 @@ python_register_toolchains(
 )
 
 http_archive(
-    name = "coverage_linux_x64",
+    name = "coverage_linux_x86_64",
     build_file_content = """
 filegroup(
     name = "coverage",
@@ -105,7 +105,7 @@ load("@bazel_tools//tools/python:toolchain.bzl", "py_runtime_pair")
 
 py_runtime(
     name = "py3_runtime",
-    coverage_tool = "@coverage_linux_x64//:coverage",
+    coverage_tool = "@coverage_linux_x86_64//:coverage",
     files = ["@python3_9_x86_64-unknown-linux-gnu//:files"],
     interpreter = "@python3_9_x86_64-unknown-linux-gnu//:bin/python3",
     python_version = "PY3",
diff --git a/src/tools/singlejar/BUILD b/src/tools/singlejar/BUILD
index 625f006ce675fd..fc54eff648ccca 100644
--- a/src/tools/singlejar/BUILD
+++ b/src/tools/singlejar/BUILD
@@ -438,6 +438,7 @@ cc_library(
         ":zip_headers",
     ],
     hdrs = ["output_jar.h"],
+    linkopts = ["-lm"],
     deps = [
         ":combiners",
         ":diag",
diff --git a/tools/jdk/BUILD.java_tools b/tools/jdk/BUILD.java_tools
index a01a945f98b925..2e6769faf4b80b 100644
--- a/tools/jdk/BUILD.java_tools
+++ b/tools/jdk/BUILD.java_tools
@@ -523,6 +523,7 @@ cc_library(
     hdrs = ["java_tools/src/tools/singlejar/output_jar.h"],
     copts = SUPRESSED_WARNINGS,
     strip_include_prefix = "java_tools",
+    linkopts = ["-lm"],
     deps = [
         ":combiners",
         ":cpp_util",