diff --git a/WORKSPACE b/WORKSPACE
index 9a2a3437592..ffd2e5cf070 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -172,9 +172,9 @@ android_sdk_repository(
 
 http_archive(
     name = "rules_foreign_cc",
-    sha256 = "2a4d07cd64b0719b39a7c12218a3e507672b82a97b98c6a89d38565894cf7c51",
-    strip_prefix = "rules_foreign_cc-0.9.0",
-    url = "https://github.com/bazelbuild/rules_foreign_cc/archive/refs/tags/0.9.0.tar.gz",
+    sha256 = "5816f4198184a1e0e682d7e6b817331219929401e2f18358fac7f7b172737976",
+    strip_prefix = "rules_foreign_cc-0.10.0",
+    url = "https://github.com/bazelbuild/rules_foreign_cc/archive/refs/tags/0.10.0.tar.gz",
 )
 
 load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
@@ -351,6 +351,25 @@ crate_universe_dependencies(bootstrap = True)
 
 load("@rules_rust//crate_universe:defs.bzl", "crate", "crates_repository")
 
+# Build jemalloc with bazel, so that we can provide it to the tikv-jemallocator build script.
+git_repository(
+    name = "jemalloc",
+    build_file = "//bazel:jemalloc.BUILD",
+    # jemalloc pointer for tikv-jemalloc-sys submodule pointer at 0.5.3
+    commit = "e13ca993e8ccb9ba9847cc330696e02839f328f7",
+
+    # Fix an issue when building jemalloc with gcc 10.3 (which is the version we
+    # currently use due to the aspect_gcc target)
+    # There's a target in the Makefile that uses the -MM flag, and
+    # when it does that, it doesn't include the $(CFLAGS).
+    # This results in __GNUC_PREREQ not being defined, which causes compiler
+    # failures.
+    # As a workaround, we patch that line in the Makefile.in to include the CFLAGS.
+    # TODO: b/341166977 Remove this when we can.
+    patch_cmds = ["sed -i '481s/-MM/$(CFLAGS) -MM/' Makefile.in"],
+    remote = "https://github.com/tikv/jemalloc",
+)
+
 # Default crate repository - some crates may require std.
 crates_repository(
     name = "oak_crates_index",
diff --git a/bazel/jemalloc.BUILD b/bazel/jemalloc.BUILD
new file mode 100644
index 00000000000..aeca1d63110
--- /dev/null
+++ b/bazel/jemalloc.BUILD
@@ -0,0 +1,34 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(["**"]),
+)
+
+# Check here for options used when jemalloc-sys builds it
+# https://github.com/tikv/jemallocator/blob/8b886be1677d1693834b158e76780a793eb3b8db/jemalloc-sys/build.rs
+configure_make(
+    name = "jemalloc",
+    autogen = True,
+    configure_in_place = True,
+    configure_options = [
+        "--disable-cxx",
+        "--enable-doc=no",
+        "--enable-shared=no",
+        "--with-jemalloc-prefix=_rjem_",
+        "--with-private-namespace=_rjem_",
+    ],
+    lib_name = "libjemalloc",
+    lib_source = ":all_srcs",
+    targets = [
+        "install_lib_static",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "gen_dir",
+    srcs = [":jemalloc"],
+    output_group = "gen_dir",
+    visibility = ["//visibility:public"],
+)
diff --git a/flake.nix b/flake.nix
index 274f8d31c22..e0631f16795 100644
--- a/flake.nix
+++ b/flake.nix
@@ -170,6 +170,9 @@
                 export GRADLE_OPTS="-Dorg.gradle.project.android.aapt2FromMavenOverride=${androidSdk}/libexec/android-sdk/build-tools/28.0.3/aapt2";
               '';
               packages = [
+                autoconf
+                autogen
+                automake
                 jdk11_headless
                 bazel
                 androidSdk
diff --git a/justfile b/justfile
index 47e02c2f688..00ec27d83df 100644
--- a/justfile
+++ b/justfile
@@ -174,7 +174,7 @@ clang-tidy:
 bare_metal_crates := "//oak_linux_boot_params //oak_channel //oak_core //oak_virtio //third_party/rust-hypervisor-firmware-virtio"
 
 bazel-ci:
-    bazel build --config=unsafe-fast-presubmit -- //...:all
+    bazel build --config=unsafe-fast-presubmit -- @jemalloc //...:all
     bazel test --config=unsafe-fast-presubmit -- //...:all
 
     # Some crates also need to be built for x86_64-unknown-none.