diff --git a/bazel/cc_toolchains/BUILD b/bazel/cc_toolchains/BUILD
index 0e9ed617e1dd..e2c4395a0f11 100644
--- a/bazel/cc_toolchains/BUILD
+++ b/bazel/cc_toolchains/BUILD
@@ -2,5 +2,39 @@
 # Exceptions. See /LICENSE for license information.
 # SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 
-# Empty `BUILD` file as this package just provides repository rule inputs to
-# configure a Clang toolchain.
+load("@bazel_skylib//lib:selects.bzl", "selects")
+
+# For use by rules.bzl.
+# Matches when asan is enabled on a macOS platform.
+selects.config_setting_group(
+    name = "macos_asan",
+    match_all = [":is_macos", ":macos_asan_build_modes"],
+)
+
+# For use by rules.bzl.
+# Matches macOS platforms.
+config_setting(
+    name = "is_macos",
+    constraint_values = ["@platforms//os:osx"],
+)
+
+# For use by rules.bzl.
+# Matches build modes where asan is enabled.
+selects.config_setting_group(
+    name = "macos_asan_build_modes",
+    match_any = [":dbg", ":fastbuild"],
+)
+
+# For use by rules.bzl.
+# Matches dbg.
+config_setting(
+    name = "dbg",
+    values = {"compilation_mode": "dbg"},
+)
+
+# For use by rules.bzl.
+# Matches fastbuild.
+config_setting(
+    name = "fastbuild",
+    values = {"compilation_mode": "fastbuild"},
+)
diff --git a/bazel/cc_toolchains/clang_configuration.bzl b/bazel/cc_toolchains/clang_configuration.bzl
index a2cd75d5154c..1a2dea9e9370 100644
--- a/bazel/cc_toolchains/clang_configuration.bzl
+++ b/bazel/cc_toolchains/clang_configuration.bzl
@@ -69,7 +69,7 @@ def _detect_system_clang(repository_ctx):
     if "clang" not in version_output:
         fail("Searching for clang or CC (%s), and found (%s), which is not a Clang compiler" % (cc, cc_path))
     clang_version, clang_version_for_cache = _clang_version(version_output)
-    return (cc_path, clang_version, clang_version_for_cache)
+    return (cc_path.realpath, clang_version, clang_version_for_cache)
 
 def _compute_clang_resource_dir(repository_ctx, clang):
     """Runs the `clang` binary to get its resource dir."""
@@ -165,16 +165,16 @@ def _configure_clang_toolchain_impl(repository_ctx):
     (clang, clang_version, clang_version_for_cache) = _detect_system_clang(
         repository_ctx,
     )
-    clang = clang.realpath.dirname.get_child("clang++")
+    clang_cpp = clang.dirname.get_child("clang++")
 
     # Compute the various directories used by Clang.
-    resource_dir = _compute_clang_resource_dir(repository_ctx, clang)
+    resource_dir = _compute_clang_resource_dir(repository_ctx, clang_cpp)
     sysroot_dir = None
     if repository_ctx.os.name.lower().startswith("mac os"):
         sysroot_dir = _compute_mac_os_sysroot(repository_ctx)
     include_dirs = _compute_clang_cpp_include_search_paths(
         repository_ctx,
-        clang,
+        clang_cpp,
         sysroot_dir,
     )
 
@@ -182,10 +182,10 @@ def _configure_clang_toolchain_impl(repository_ctx):
     # First look for llvm-ar adjacent to clang, so that if found,
     # it is most likely to match the same version as clang.
     # Otherwise, try PATH.
-    arpath = clang.dirname.get_child("llvm-ar")
-    if not arpath.exists:
-        arpath = repository_ctx.which("llvm-ar")
-        if not arpath:
+    ar_path = clang.dirname.get_child("llvm-ar")
+    if not ar_path.exists:
+        ar_path = repository_ctx.which("llvm-ar")
+        if not ar_path:
             fail("`llvm-ar` not found in PATH or adjacent to clang")
 
     # By default Windows uses '\' in its paths. These will be
@@ -199,7 +199,8 @@ def _configure_clang_toolchain_impl(repository_ctx):
         "clang_detected_variables.bzl",
         repository_ctx.attr._clang_detected_variables_template,
         substitutions = {
-            "{LLVM_BINDIR}": str(arpath.dirname),
+            "{LLVM_BINDIR}": str(ar_path.dirname),
+            "{LLVM_SYMBOLIZER}": str(ar_path.dirname.get_child("llvm-symbolizer")),
             "{CLANG_BINDIR}": str(clang.dirname),
             "{CLANG_VERSION}": str(clang_version),
             "{CLANG_VERSION_FOR_CACHE}": clang_version_for_cache.replace('"', "_").replace("\\", "_"),
diff --git a/bazel/cc_toolchains/clang_detected_variables.tpl.bzl b/bazel/cc_toolchains/clang_detected_variables.tpl.bzl
index 372474694cfc..3cb83b275950 100644
--- a/bazel/cc_toolchains/clang_detected_variables.tpl.bzl
+++ b/bazel/cc_toolchains/clang_detected_variables.tpl.bzl
@@ -9,6 +9,7 @@ This file gets processed by a repository rule, substituting the
 """
 
 llvm_bindir = "{LLVM_BINDIR}"
+llvm_symbolizer = "{LLVM_SYMBOLIZER}"
 clang_bindir = "{CLANG_BINDIR}"
 clang_version = {CLANG_VERSION}
 clang_version_for_cache = "{CLANG_VERSION_FOR_CACHE}"
diff --git a/bazel/cc_toolchains/defs.bzl b/bazel/cc_toolchains/defs.bzl
new file mode 100644
index 000000000000..3025d17f2452
--- /dev/null
+++ b/bazel/cc_toolchains/defs.bzl
@@ -0,0 +1,22 @@
+# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
+# Exceptions. See /LICENSE for license information.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+"""Provides helpers for cc rules. Intended for general consumption."""
+
+load("@bazel_cc_toolchain//:clang_detected_variables.bzl", "llvm_symbolizer")
+
+def cc_env():
+    """Returns standard environment settings for a cc_binary."""
+    env = {"LLVM_SYMBOLIZER_PATH": llvm_symbolizer}
+
+    # On macOS, there's a nano zone allocation warning due to asan (arises
+    # in fastbuild/dbg). This suppresses the warning in `bazel run`.
+    #
+    # Concatenation of a dict with a select isn't supported, so we concatenate
+    # within the select.
+    # https://github.com/bazelbuild/bazel/issues/12457
+    return select({
+        "//bazel/cc_toolchains:macos_asan": env.update({"MallocNanoZone": "0"}),
+        "//conditions:default": env,
+    })
diff --git a/bazel/macos_malloc/BUILD b/bazel/macos_malloc/BUILD
deleted file mode 100644
index fa7dce88f1f1..000000000000
--- a/bazel/macos_malloc/BUILD
+++ /dev/null
@@ -1,32 +0,0 @@
-# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
-# Exceptions. See /LICENSE for license information.
-# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-
-load("@bazel_skylib//lib:selects.bzl", "selects")
-
-exports_files(["env.bzl"])
-
-selects.config_setting_group(
-    name = "macos_asan",
-    match_all = [":is_macos", ":macos_asan_build_modes"],
-)
-
-config_setting(
-    name = "is_macos",
-    constraint_values = ["@platforms//os:osx"],
-)
-
-selects.config_setting_group(
-    name = "macos_asan_build_modes",
-    match_any = [":dbg", ":fastbuild"],
-)
-
-config_setting(
-    name = "dbg",
-    values = {"compilation_mode": "dbg"},
-)
-
-config_setting(
-    name = "fastbuild",
-    values = {"compilation_mode": "fastbuild"},
-)
diff --git a/bazel/macos_malloc/env.bzl b/bazel/macos_malloc/env.bzl
deleted file mode 100644
index 99f48413a17c..000000000000
--- a/bazel/macos_malloc/env.bzl
+++ /dev/null
@@ -1,16 +0,0 @@
-# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
-# Exceptions. See /LICENSE for license information.
-# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-
-"""Provides support for macOS-specific malloc issues."""
-
-def macos_malloc_env():
-    """Disable nano malloc when running asan.
-
-    On macOS, there's a nano zone allocation warning due to asan (arises
-    in fastbuild/dbg). This suppresses the warning in `bazel run`.
-    """
-    return select({
-        "//bazel/macos_malloc:macos_asan": {"MallocNanoZone": "0"},
-        "//conditions:default": {},
-    })
diff --git a/explorer/BUILD b/explorer/BUILD
index 3b1071acdafe..c3b76ba92f8d 100644
--- a/explorer/BUILD
+++ b/explorer/BUILD
@@ -2,7 +2,7 @@
 # Exceptions. See /LICENSE for license information.
 # SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 
-load("//bazel/macos_malloc:env.bzl", "macos_malloc_env")
+load("//bazel/cc_toolchains:defs.bzl", "cc_env")
 
 package(default_visibility = [
     "//bazel/check_deps:__pkg__",
@@ -33,7 +33,7 @@ cc_library(
 cc_binary(
     name = "explorer",
     srcs = ["main_bin.cpp"],
-    env = macos_malloc_env(),
+    env = cc_env(),
     deps = [
         ":main",
         "//common:bazel_working_dir",
diff --git a/toolchain/driver/BUILD b/toolchain/driver/BUILD
index 11b951179c25..2e99dd7d4021 100644
--- a/toolchain/driver/BUILD
+++ b/toolchain/driver/BUILD
@@ -2,6 +2,7 @@
 # Exceptions. See /LICENSE for license information.
 # SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 
+load("//bazel/cc_toolchains:defs.bzl", "cc_env")
 load("//bazel/fuzzing:rules.bzl", "cc_fuzz_test")
 
 package(default_visibility = ["//visibility:public"])
@@ -53,6 +54,7 @@ cc_fuzz_test(
 cc_binary(
     name = "carbon",
     srcs = ["driver_main.cpp"],
+    env = cc_env(),
     deps = [
         ":driver",
         "//common:bazel_working_dir",