diff --git a/tools/BUILD b/tools/BUILD
index 2be1cea..d80ad4d 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -49,3 +49,9 @@
     srcs = ["calicoctl.sh"],
     data = [":calicoctl.bin", ":secretstore"],
 )
+
+copy_go_binary(
+    name = "cfssl",
+    src = "@com_github_cloudflare_cfssl//cmd/cfssl:cfssl",
+    visibility = ["//visibility:public"],
+)