diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
index ce56bda801..9e99e0f650 100644
--- a/toolchain/BUILD.bazel
+++ b/toolchain/BUILD.bazel
@@ -7,8 +7,6 @@ licenses(["notice"])
 
 exports_files_legacy()
 
-package(default_visibility = ["//visibility:public"])
-
 # https://bazel.build/reference/be/c-cpp#cc_toolchain_suite
 # cc_toolchain_suite will fetch deps for toolchains it will not use, which
 # is why we split up the suites by OS. When attempting to fetch "@clang_linux_amd64//:all_files",
@@ -37,13 +35,28 @@ cc_toolchain_suite(
 filegroup(name = "not_implemented")
 
 filegroup(
-    name = "all_linux_amd64_files",
+    name = "archive_linux_amd64_files",
+    srcs = [
+        "linux_trampolines/ar_trampoline_linux.sh",
+        "@clang_linux_amd64//:archive_files",
+    ],
+)
+
+filegroup(
+    name = "compile_linux_amd64_files",
     srcs = [
         "linux_trampolines/IWYU_mapping.imp",
-        "linux_trampolines/ar_trampoline_linux.sh",
         "linux_trampolines/clang_trampoline_linux.sh",
-        "linux_trampolines/lld_trampoline_linux.sh",
-        "@clang_linux_amd64//:all_files",
+        "@clang_linux_amd64//:compile_files",
+    ],
+)
+
+filegroup(
+    name = "link_linux_amd64_files",
+    srcs = [
+        # Bazel assumes it is talking to Clang when linking.
+        "linux_trampolines/clang_trampoline_linux.sh",
+        "@clang_linux_amd64//:link_files",
     ],
 )
 
@@ -68,11 +81,11 @@ provide_mac_m1_toolchain_config(
 # https://bazel.build/reference/be/c-cpp#cc_toolchain
 cc_toolchain(
     name = "linux_amd64_host",
-    all_files = ":all_linux_amd64_files",
-    ar_files = ":all_linux_amd64_files",
-    compiler_files = ":all_linux_amd64_files",
+    all_files = ":not_implemented",
+    ar_files = ":archive_linux_amd64_files",
+    compiler_files = ":compile_linux_amd64_files",
     dwp_files = ":not_implemented",
-    linker_files = ":all_linux_amd64_files",
+    linker_files = ":link_linux_amd64_files",
     objcopy_files = ":not_implemented",
     strip_files = ":not_implemented",
     supports_param_files = False,
diff --git a/toolchain/download_linux_amd64_toolchain.bzl b/toolchain/download_linux_amd64_toolchain.bzl
index 06d6586ca5..0b8c924141 100644
--- a/toolchain/download_linux_amd64_toolchain.bzl
+++ b/toolchain/download_linux_amd64_toolchain.bzl
@@ -166,7 +166,7 @@ def _download_and_extract_deb(ctx, deb, sha256, prefix, output = ""):
         fail("Could not open deb.ar from " + deb)
 
     # https://bazel.build/rules/lib/repository_ctx#extract
-    extract_info = ctx.extract(
+    ctx.extract(
         archive = "tmp/data.tar.xz",
         output = output,
         stripPrefix = prefix,
@@ -205,18 +205,59 @@ def _download_linux_amd64_toolchain_impl(ctx):
             ".",
         )
 
-    # Create a BUILD.bazel file that makes all the files in this subfolder
-    # available for use in rules, i.e. in the toolchain declaration.
+    # Create a BUILD.bazel file that makes the files downloaded into the toolchain visible.
+    # We have separate groups for each task because doing less work (sandboxing fewer files
+    # or uploading less data to RBE) makes compiles go faster. We try to strike a balance
+    # between minimal specifications and not having to edit this file often with our use
+    # of globs.
     # https://bazel.build/rules/lib/repository_ctx#file
     ctx.file(
         "BUILD.bazel",
         content = """
 filegroup(
-    name = "all_files",
-    srcs = glob([
-        "**",
-    ]),
-    visibility = ["//visibility:public"]
+    name = "archive_files",
+    srcs = [
+        "bin/llvm-ar",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "compile_files",
+    srcs = [
+        "bin/clang",
+        "usr/bin/include-what-you-use",
+    ] + glob(
+        include = [
+            "include/c++/v1/**",
+            "usr/include/**",
+            "lib/clang/13.0.0/**",
+            "usr/include/x86_64-linux-gnu/**",
+        ],
+        allow_empty = False,
+    ),
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "link_files",
+    srcs = [
+        "bin/clang",
+        "bin/ld.lld",
+        "bin/lld",
+        "lib/libc++.a",
+        "lib/libc++abi.a",
+        "lib/libunwind.a",
+        "lib64/ld-linux-x86-64.so.2",
+    ] + glob(
+        include = [
+            "lib/clang/13.0.0/lib/**",
+            "lib/x86_64-linux-gnu/**",
+            "usr/lib/x86_64-linux-gnu/**",
+        ],
+        allow_empty = False,
+    ),
+    visibility = ["//visibility:public"],
 )
 """,
         executable = False,