diff --git a/.bazelrc b/.bazelrc
index c47472bdad..2a72ab5654 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -20,19 +20,21 @@ build --@io_bazel_rules_docker//transitions:enable=false
 build --flag_alias=clang_version=//:clang_version
 build --flag_alias=gcc_version=//:gcc_version
 
+# Use optimized build by default. According to the bazel documentation, this
+# corresponds to -O2 -DNDEBUG, but these are overriden in
+# //bazel/common_settings.bzl:vere_library.
+# https://bazel.build/docs/user-manual#build-semantics
+build --compilation_mode=opt
+
 # Don't include source level debug info on macOS. See
 # https://github.com/urbit/urbit/issues/5561 and
 # https://github.com/urbit/vere/issues/131.
-build:linux --per_file_copt='pkg/.*@-g'
 build:linux --host_copt='-g'
 build --strip=never
 
-# Use -O3 as the default optimization level.
-build --per_file_copt='pkg/.*@-O3'
+# Turn on optimization, CPU and memory debug for exec config, which we only use
+# to run the fake ship tests.  Also turn on extra snapshot validation.
 build --host_copt='-O3'
-
-# Turn on CPU and memory debug for exec config, which we only use to run the
-# fake ship tests.  Also turn on extra snapshot validation.
 build --host_copt='-DU3_CPU_DEBUG'
 build --host_copt='-DU3_MEMORY_DEBUG'
 build --host_copt='-DC3DBG'
@@ -45,12 +47,5 @@ build:mem_dbg --per_file_copt='pkg/.*@-DU3_MEMORY_DEBUG'
 build:cpu_dbg --per_file_copt='pkg/.*@-DU3_CPU_DEBUG'
 build:snp_dbg --per_file_copt='pkg/.*@-DU3_SNAPSHOT_VALIDATION'
 
-# Enable maximum debug info and disable optimizations for debug config. It's
-# important that these lines come after setting the default debug and
-# optimization level flags above.
-build:dbg --per_file_copt='pkg/.*@-O0'
-build:dbg --per_file_copt='pkg/.*@-g3'
-build:dbg --per_file_copt='pkg/.*@-DC3DBG'
-
 # Any personal configuration should go in .user.bazelrc.
 try-import %workspace%/.user.bazelrc
diff --git a/BUILD.bazel b/BUILD.bazel
index 304ecb66d4..ff11949f5f 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -37,6 +37,38 @@ config_setting(
     ],
 )
 
+#
+# CONFIGS DETAILING WHEN TO ENABLE CERTAIN FEATURES BY DEFAULT.
+# CHANGES BEHAVIOR OF //bazel/common_settings.bzl:vere_library.
+#
+
+config_setting(
+    name = "thinlto",
+    constraint_values = [
+        "@platforms//os:macos",
+    ],
+    values = {
+        "compilation_mode": "opt"
+    }
+)
+
+config_setting(
+    name = "lto",
+    constraint_values = [
+        "@platforms//os:linux",
+    ],
+    values = {
+        "compilation_mode": "opt"
+    }
+)
+
+config_setting(
+    name = "debug",
+    values = {
+        "compilation_mode": "dbg"
+    }
+)
+
 #
 # COMPILERS
 #
diff --git a/INSTALL.md b/INSTALL.md
index f9eb54c42e..e30f14f88e 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -60,9 +60,10 @@ bazel build :urbit
 ```
 
 If you want a debug build, which changes the optimization level from `-O3` to
-`-O0` and includes more debugging information, specify the `dbg` configuration:
+`-O0` and includes more debugging information, specify `dbg` as the
+`compilation_mode`:
 ```console
-bazel build --config=dbg :urbit
+bazel build --compilation_mode=dbg :urbit
 ```
 Note that you cannot change the optimization level for third party
 dependencies--those targets specified in `bazel/third_party`--from the command
diff --git a/bazel/common_settings.bzl b/bazel/common_settings.bzl
index 945447d3c5..6a61de1292 100644
--- a/bazel/common_settings.bzl
+++ b/bazel/common_settings.bzl
@@ -10,3 +10,50 @@ string_flag = rule(
     build_setting = config.string(flag = True),
     doc = "A string-typed build setting that can be set on the command line",
 )
+
+def vere_library(copts = [], linkopts = [], **kwargs):
+  native.cc_library(
+    copts = copts + select({
+        "//:debug": ["-O0", "-g3", "-DC3DBG"],
+        "//conditions:default": ["-O3"]
+    }) + select({
+        "//:lto": ['-flto'],
+        "//:thinlto": ['-flto=thin'],
+        "//conditions:default": []
+    }) + select({
+        # Don't include source level debug info on macOS. See
+        # https://github.com/urbit/urbit/issues/5561 and
+        # https://github.com/urbit/vere/issues/131.
+        "//:debug": [],
+        "@platforms//os:linux": ["-g"],
+        "//conditions:default": [],
+    }),
+    linkopts = linkopts + ['-g'] + select({
+        "//:lto": ['-flto'],
+        "//:thinlto": ['-flto=thin'],
+        "//conditions:default": []
+    }),
+    **kwargs,
+  )
+
+def vere_binary(copts = [], linkopts = [], **kwargs):
+  native.cc_binary(
+    copts = copts + select({
+        "//:debug": ["-O0", "-g3", "-DC3DBG"],
+        "//conditions:default": ["-O3"]
+    }) + select({
+        "//:lto": ['-flto'],
+        "//:thinlto": ['-flto=thin'],
+        "//conditions:default": []
+    }) + select({
+        "//:debug": [],
+        "@platforms//os:linux": ["-g"],
+        "//conditions:default": [],
+    }),
+    linkopts = linkopts + ['-g'] + select({
+        "//:lto": ['-flto'],
+        "//:thinlto": ['-flto=thin'],
+        "//conditions:default": []
+    }),
+    **kwargs,
+  )
diff --git a/bazel/toolchain/BUILD.bazel b/bazel/toolchain/BUILD.bazel
index a68b1a2284..aaed5de087 100644
--- a/bazel/toolchain/BUILD.bazel
+++ b/bazel/toolchain/BUILD.bazel
@@ -50,7 +50,7 @@ _aarch64_gcc = "toolchain-gcc-linux-aarch64"
 
 cc_toolchain_config(
     name = "gcc-linux-aarch64-config",
-    ar = "{}/aarch64-linux-musl/bin/aarch64-linux-musl-ar".format(_install_prefix),
+    ar = "{}/aarch64-linux-musl/bin/aarch64-linux-musl-gcc-ar".format(_install_prefix),
     cc = "{}/aarch64-linux-musl/bin/aarch64-linux-musl-gcc".format(_install_prefix),
     cc_flags = [
         "-static",
@@ -104,7 +104,7 @@ _x86_64_gcc = "toolchain-gcc-linux-x86_64"
 
 cc_toolchain_config(
     name = "gcc-linux-x86_64-config",
-    ar = "{}/x86_64-linux-musl/bin/x86_64-linux-musl-ar".format(_install_prefix),
+    ar = "{}/x86_64-linux-musl/bin/x86_64-linux-musl-gcc-ar".format(_install_prefix),
     cc = "{}/x86_64-linux-musl/bin/x86_64-linux-musl-gcc".format(_install_prefix),
     cc_flags = [
         "-static",
@@ -279,7 +279,7 @@ cc_toolchain_config(
     # NOTE: building with `libtool` does not work on macOS due to lack of
     # support in the `configure_make` rule provided by `rules_foreign_cc`.
     # Therefore, we require setting `ar` as the archiver tool on macOS.
-    ar = "/usr/bin/ar",
+    ar = "/usr/local/opt/llvm@15/bin/llvm-ar",
     # By default, Bazel passes the `rcsD` flags to `ar`, but macOS's `ar`
     # implementation doesn't support `D`. We remove it with this attribute
     # and corresponding `ar_flags_feature` in `cfg.bzl`.
@@ -288,7 +288,8 @@ cc_toolchain_config(
     cc = "/usr/local/opt/llvm@15/bin/clang",
     compiler = "clang",
     compiler_version = "//:clang_version",
-    ld = "/usr/bin/ld",
+    ld = "/usr/local/opt/llvm@15/bin/llvm-lld",
+    nm = "/usr/local/opt/llvm@15/bin/llvm-nm",
     sys_includes = [
         "/usr/local/Cellar/llvm@15/15.0.7/lib/clang/15.0.7/include",
         "/Library/Developer/CommandLineTools/SDKs/MacOSX12.sdk/usr/include",
diff --git a/pkg/c3/BUILD.bazel b/pkg/c3/BUILD.bazel
index 45df2368db..95b790b5ec 100644
--- a/pkg/c3/BUILD.bazel
+++ b/pkg/c3/BUILD.bazel
@@ -2,7 +2,9 @@
 # LIBRARIES
 #
 
-cc_library(
+load("//bazel:common_settings.bzl", "vere_library")
+
+vere_library(
     name = "c3",
     srcs = glob(
         [
diff --git a/pkg/ent/BUILD.bazel b/pkg/ent/BUILD.bazel
index c3c12e3de2..ad9894b1e2 100644
--- a/pkg/ent/BUILD.bazel
+++ b/pkg/ent/BUILD.bazel
@@ -2,7 +2,9 @@
 # LIBRARIES
 #
 
-cc_library(
+load("//bazel:common_settings.bzl", "vere_library")
+
+vere_library(
     name = "ent",
     srcs = ["ent.c"],
     hdrs = ["ent.h"],
diff --git a/pkg/noun/BUILD.bazel b/pkg/noun/BUILD.bazel
index 393f649eb1..964e4bf60f 100644
--- a/pkg/noun/BUILD.bazel
+++ b/pkg/noun/BUILD.bazel
@@ -2,7 +2,9 @@
 # LIBRARIES
 #
 
-cc_library(
+load("//bazel:common_settings.bzl", "vere_library")
+
+vere_library(
     name = "noun",
     srcs = glob(
         [
diff --git a/pkg/ur/BUILD.bazel b/pkg/ur/BUILD.bazel
index e47e798702..4deff1e706 100644
--- a/pkg/ur/BUILD.bazel
+++ b/pkg/ur/BUILD.bazel
@@ -2,7 +2,9 @@
 # LIBRARIES
 #
 
-cc_library(
+load("//bazel:common_settings.bzl", "vere_library")
+
+vere_library(
     name = "ur",
     srcs = [
         "bitstream.c",
diff --git a/pkg/urcrypt/BUILD.bazel b/pkg/urcrypt/BUILD.bazel
index b4b3d79a4f..22108ea72c 100644
--- a/pkg/urcrypt/BUILD.bazel
+++ b/pkg/urcrypt/BUILD.bazel
@@ -2,7 +2,9 @@
 # LIBRARIES
 #
 
-cc_library(
+load("//bazel:common_settings.bzl", "vere_library")
+
+vere_library(
     name = "urcrypt",
     srcs = glob(
         [
diff --git a/pkg/urcrypt/ge-additions/BUILD.bazel b/pkg/urcrypt/ge-additions/BUILD.bazel
index 9dea2d305b..06ab7c3e5a 100644
--- a/pkg/urcrypt/ge-additions/BUILD.bazel
+++ b/pkg/urcrypt/ge-additions/BUILD.bazel
@@ -1,4 +1,6 @@
-cc_library(
+load("//bazel:common_settings.bzl", "vere_library")
+
+vere_library(
     name = "ge-additions",
     srcs = ["ge-additions.c"],
     hdrs = ["ge-additions.h"],
diff --git a/pkg/vere/BUILD.bazel b/pkg/vere/BUILD.bazel
index b4d68ef44a..76f8b47eca 100644
--- a/pkg/vere/BUILD.bazel
+++ b/pkg/vere/BUILD.bazel
@@ -2,6 +2,8 @@
 # GENERATED FILES
 #
 
+load("//bazel:common_settings.bzl", "vere_library", "vere_binary")
+
 # An approximation of `xxd -i` that runs on all platforms where Bash is
 # present. Generates a `.h` file that declares the array and array length as
 # `extern` global variables and a `.c` file containing the array and array
@@ -86,7 +88,7 @@ genrule(
 # LIBRARIES
 #
 
-cc_library(
+vere_library(
     name = "vere",
     srcs = glob(
         [
@@ -138,7 +140,7 @@ cc_library(
 # BINARIES
 #
 
-cc_binary(
+vere_binary(
     name = "urbit",
     srcs = [
         "main.c",