diff --git a/justfile b/justfile
index 20179cf89f8..9d8df4d0ac5 100644
--- a/justfile
+++ b/justfile
@@ -202,8 +202,9 @@ kokoro_run_tests: all_ensure_no_std
 clang-tidy:
     bazel build $BAZEL_CONFIG_FLAG --config=clang-tidy //cc/...
 
-# TODO: b/343228114 - Use a Bazel tag instead of listing packages here.
-bare_metal_crates := "//oak_linux_boot_params //oak_channel //oak_core //oak_virtio //third_party/rust-hypervisor-firmware-virtio //micro_rpc //oak_proto_rust //oak_sev_snp_attestation_report //oak_sev_guest //sev_serial //oak_crypto //oak_dice //oak_restricted_kernel_dice"
+# Query crates that needs to be built for bare metal. Bazel query outputs one target in each line, so we
+# use `tr` to bring them into a single line.
+bare_metal_crates := `bazel query 'attr("tags", "ci-build-for-x86_64-unknown-none", //...)' | tr '\n' ' '`
 
 bazel-ci:
     # Test Oak as a dependency in the test workspace
@@ -224,6 +225,9 @@ bazel-repin:
     env CARGO_BAZEL_REPIN=true bazel sync --only=oak_crates_index,oak_no_std_crates_index
     env CARGO_BAZEL_REPIN=true --chdir=bazel/test_workspace bazel sync --only=oak2
 
+bazel-fmt:
+    buildifier -r ${PWD}  # Lints Bazel files - BUILD, WORKSPACE, *.bzl, etc.
+
 bazel-rustfmt:
     bazel build --config=rustfmt --config=unsafe-fast-presubmit //...:all -- -third_party/...
 
@@ -231,7 +235,7 @@ xtask job:
     ./scripts/xtask {{job}}
 
 clippy-ci: (xtask "run-cargo-clippy") bazel-clippy
-check-format-ci: (xtask "check-format") bazel-rustfmt
+check-format-ci: (xtask "check-format") bazel-fmt
 
 # Temporary target to help debugging Bazel remote cache with more detailed logs.
 # It should be deleted when debugging is completed.
diff --git a/micro_rpc/BUILD b/micro_rpc/BUILD
index 8d0c5dd5ac5..dc2b9f0eb1b 100644
--- a/micro_rpc/BUILD
+++ b/micro_rpc/BUILD
@@ -29,6 +29,7 @@ rust_library(
         "@oak_crates_index//:async-trait",
         "@oak_crates_index//:prost-derive",
     ],
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         ":build",
     ] + select({
diff --git a/oak_channel/BUILD b/oak_channel/BUILD
index ba78c059d3d..afb692eee80 100644
--- a/oak_channel/BUILD
+++ b/oak_channel/BUILD
@@ -24,6 +24,7 @@ package(
 rust_library(
     name = "oak_channel",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "//oak_core",
         "@oak_crates_index//:static_assertions",
diff --git a/oak_core/BUILD b/oak_core/BUILD
index ce7850ca060..39118b98232 100644
--- a/oak_core/BUILD
+++ b/oak_core/BUILD
@@ -24,6 +24,7 @@ package(
 rust_library(
     name = "oak_core",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "@oak_crates_index//:lock_api",
         "@oak_crates_index//:spinning_top",
diff --git a/oak_crypto/BUILD b/oak_crypto/BUILD
index 7838fbac943..4f46ca548db 100644
--- a/oak_crypto/BUILD
+++ b/oak_crypto/BUILD
@@ -31,6 +31,7 @@ rust_library(
     proc_macro_deps = [
         "@oak_crates_index//:async-trait",
     ],
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "//oak_proto_rust",
         "@oak_crates_index//:static_assertions",
diff --git a/oak_dice/BUILD b/oak_dice/BUILD
index 15e7b89cc2e..43b167609b2 100644
--- a/oak_dice/BUILD
+++ b/oak_dice/BUILD
@@ -27,6 +27,7 @@ rust_library(
     crate_features = [
         "no_std",
     ],
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "@oak_crates_index//:static_assertions",
         "@oak_crates_index//:strum",
diff --git a/oak_linux_boot_params/BUILD b/oak_linux_boot_params/BUILD
index 634799c764e..e5c692b6a5c 100644
--- a/oak_linux_boot_params/BUILD
+++ b/oak_linux_boot_params/BUILD
@@ -24,6 +24,7 @@ package(
 rust_library(
     name = "oak_linux_boot_params",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "@oak_crates_index//:static_assertions",
         "@oak_crates_index//:strum",
diff --git a/oak_proto_rust/BUILD b/oak_proto_rust/BUILD
index ba6a37d2ff5..f33e74c6e01 100644
--- a/oak_proto_rust/BUILD
+++ b/oak_proto_rust/BUILD
@@ -28,6 +28,7 @@ rust_library(
     proc_macro_deps = [
         "@oak_crates_index//:prost-derive",
     ],
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         ":build",
         "//micro_rpc",
diff --git a/oak_restricted_kernel_dice/BUILD b/oak_restricted_kernel_dice/BUILD
index 048ede73115..623b9928f2f 100644
--- a/oak_restricted_kernel_dice/BUILD
+++ b/oak_restricted_kernel_dice/BUILD
@@ -24,6 +24,7 @@ package(
 rust_library(
     name = "oak_restricted_kernel_dice",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "//oak_crypto",
         "//oak_dice",
diff --git a/oak_sev_guest/BUILD b/oak_sev_guest/BUILD
index c16fa3c9ff9..67ccd912d3f 100644
--- a/oak_sev_guest/BUILD
+++ b/oak_sev_guest/BUILD
@@ -27,6 +27,7 @@ rust_library(
     crate_features = [
         "rust-crypto",
     ],
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "//oak_sev_snp_attestation_report",
         "@oak_crates_index//:lock_api",
diff --git a/oak_sev_snp_attestation_report/BUILD b/oak_sev_snp_attestation_report/BUILD
index b8e9a34db7c..a2d1fe9f238 100644
--- a/oak_sev_snp_attestation_report/BUILD
+++ b/oak_sev_snp_attestation_report/BUILD
@@ -24,6 +24,7 @@ package(
 rust_library(
     name = "oak_sev_snp_attestation_report",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "@oak_crates_index//:static_assertions",
         "@oak_crates_index//:strum",
diff --git a/oak_virtio/BUILD b/oak_virtio/BUILD
index 35292ff7f82..d4d1d439b4e 100644
--- a/oak_virtio/BUILD
+++ b/oak_virtio/BUILD
@@ -24,6 +24,7 @@ package(
 rust_library(
     name = "oak_virtio",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "//third_party/rust-hypervisor-firmware-virtio",
         "@oak_crates_index//:strum",
diff --git a/sev_serial/BUILD b/sev_serial/BUILD
index 086b736d40e..25c9c758b43 100644
--- a/sev_serial/BUILD
+++ b/sev_serial/BUILD
@@ -24,6 +24,7 @@ package(
 rust_library(
     name = "sev_serial",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "//oak_sev_guest",
     ] + select({
diff --git a/third_party/rust-hypervisor-firmware-virtio/BUILD b/third_party/rust-hypervisor-firmware-virtio/BUILD
index dee065f89b5..6c1c052364b 100644
--- a/third_party/rust-hypervisor-firmware-virtio/BUILD
+++ b/third_party/rust-hypervisor-firmware-virtio/BUILD
@@ -23,6 +23,7 @@ package(
 rust_library(
     name = "rust-hypervisor-firmware-virtio",
     srcs = glob(["src/**"]),
+    tags = ["ci-build-for-x86_64-unknown-none"],
     deps = [
         "@oak_crates_index//:atomic_refcell",
         "@oak_no_std_crates_index//:bitflags",