diff --git a/Makefile b/Makefile
index 362ce4b5..d3d6b304 100644
--- a/Makefile
+++ b/Makefile
@@ -61,7 +61,7 @@ check-extra:
         # Restrict loaded Starlark files in public packages to well-known
         # official repositories to avoid dependency creep.
 	! $(GIT) grep -I -r -E -n -e '^load\("@' \
-	  --and --not -e '@(bazel_skylib|protobuf|rules_cc)//' \
+	  --and --not -e '@(bazel_tools|bazel_skylib|protobuf|rules_cc)//' \
 	  -- elisp emacs
         # Find BUILD files without default visibility.  See
         # https://opensource.google/documentation/reference/thirdparty/new_license_rules#new_requirements.
diff --git a/elisp/private/BUILD b/elisp/private/BUILD
index a0af2981..3e1e9c39 100644
--- a/elisp/private/BUILD
+++ b/elisp/private/BUILD
@@ -1,4 +1,4 @@
-# Copyright 2025 Philipp Stephani
+# Copyright 2025-2026 Philipp Stephani
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -265,6 +265,7 @@ bzl_library(
 bzl_library(
     name = "emacs_repository",
     srcs = ["emacs_repository.bzl"],
+    deps = ["@bazel_tools//tools/build_defs/repo:utils.bzl"],
 )
 
 bzl_library(
diff --git a/elisp/private/emacs_repository.bzl b/elisp/private/emacs_repository.bzl
index d6b85776..6de16986 100644
--- a/elisp/private/emacs_repository.bzl
+++ b/elisp/private/emacs_repository.bzl
@@ -1,4 +1,4 @@
-# Copyright 2023-2025 Google LLC
+# Copyright 2023-2026 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,14 +14,18 @@
 
 """Defines the `emacs_repository` repository rule."""
 
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "get_auth")
+
 visibility("private")
 
 def _emacs_repository_impl(ctx):
+    urls = ctx.attr.urls
     ctx.download_and_extract(
         integrity = ctx.attr.integrity or fail("archive integrity missing"),
-        url = ctx.attr.urls,
+        url = urls,
         stripPrefix = ctx.attr.strip_prefix,
         type = ctx.attr.format,
+        auth = get_auth(ctx, urls),
     )
     ctx.delete("test")
     ctx.template(
@@ -43,6 +47,8 @@ emacs_repository = repository_rule(
     # @unsorted-dict-items
     attrs = {
         "urls": attr.string_list(mandatory = True, allow_empty = False),
+        "netrc": attr.label(allow_single_file = [".netrc"]),
+        "auth_patterns": attr.string_dict(),
         "format": attr.string(mandatory = True, values = ["zip", "tar.gz", "tar.xz"]),
         "integrity": attr.string(mandatory = True),
         "strip_prefix": attr.string(mandatory = True),