diff --git a/toolchain/internal/configure.bzl b/toolchain/internal/configure.bzl
index acc5135e..ec2bb3bc 100644
--- a/toolchain/internal/configure.bzl
+++ b/toolchain/internal/configure.bzl
@@ -615,6 +615,7 @@ native_binary(
 
 def _is_hermetic_or_exists(rctx, path, sysroot_path):
     path = path.replace("%sysroot%", sysroot_path).replace("//", "/")
+    path = path.removeprefix("%workspace%")
     if not path.startswith("/"):
         return True
     return rctx.path(path).exists