diff --git a/docs/pyproject.toml b/docs/pyproject.toml
index 9a089df59c..c928720a22 100644
--- a/docs/pyproject.toml
+++ b/docs/pyproject.toml
@@ -13,5 +13,6 @@ dependencies = [
     "absl-py",
     "typing-extensions",
     "sphinx-reredirects",
-    "pefile"
+    "pefile",
+    "pyelftools",
 ]
diff --git a/docs/requirements.txt b/docs/requirements.txt
index c05554aeeb..e4a4365185 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -236,6 +236,10 @@ pefile==2024.8.26 \
     --hash=sha256:3ff6c5d8b43e8c37bb6e6dd5085658d658a7a0bdcd20b6a07b1fcfc1c4e9d632 \
     --hash=sha256:76f8b485dcd3b1bb8166f1128d395fa3d87af26360c2358fb75b80019b957c6f
     # via rules-python-docs (docs/pyproject.toml)
+pyelftools==0.32 \
+    --hash=sha256:013df952a006db5e138b1edf6d8a68ecc50630adbd0d83a2d41e7f846163d738 \
+    --hash=sha256:6de90ee7b8263e740c8715a925382d4099b354f29ac48ea40d840cf7aa14ace5
+    # via rules-python-docs (docs/pyproject.toml)
 pygments==2.19.2 \
     --hash=sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887 \
     --hash=sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b
diff --git a/python/cc/py_extension.bzl b/python/cc/py_extension.bzl
new file mode 100644
index 0000000000..72a9ce843c
--- /dev/null
+++ b/python/cc/py_extension.bzl
@@ -0,0 +1,8 @@
+"""Public API for py_extension."""
+
+load(
+    "//python/private/cc:py_extension_macro.bzl",
+    _py_extension = "py_extension",
+)
+
+py_extension = _py_extension
diff --git a/python/private/cc/py_extension_macro.bzl b/python/private/cc/py_extension_macro.bzl
new file mode 100644
index 0000000000..715ae5e3b6
--- /dev/null
+++ b/python/private/cc/py_extension_macro.bzl
@@ -0,0 +1,108 @@
+"""Macro for creating Python extensions."""
+
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("@rules_cc//cc:cc_shared_library.bzl", "cc_shared_library")
+load("//python/private:util.bzl", "add_tag")
+load(":py_extension_rule.bzl", "py_extension_wrapper")
+
+def py_extension(
+        name,
+        srcs = None,
+        hdrs = None,
+        copts = None,
+        defines = None,
+        deps = None,
+        dynamic_deps = None,
+        exports_filter = None,
+        user_link_flags = None,
+        visibility = None,
+        data = None,
+        **kwargs):
+    """Creates a Python extension module.
+
+    Args:
+        name: Target name.
+        srcs: Optional C/C++ source files to compile directly for this extension.
+        hdrs: Optional header files for the srcs.
+        copts: Optional compiler flags for srcs.
+        defines: Optional preprocessor defines for srcs.
+        deps: cc_library targets to statically link into the extension.
+        dynamic_deps: cc_shared_library targets to dynamically link.
+        exports_filter: Filter for exported symbols passed to cc_shared_library.
+        user_link_flags: Additional link flags passed to cc_shared_library.
+        visibility: Target visibility.
+        data: Optional list of files or targets needed by this extension at runtime.
+        **kwargs: Additional arguments passed to the underlying wrapper rule.
+    """
+    add_tag(kwargs, "@rules_python//python/cc:py_extension")
+
+    csl_deps = []
+
+    # 1. Handle user-supplied static deps
+    if deps:
+        csl_deps.extend(deps)
+
+    # 2. If srcs or hdrs are specified, create an implicit cc_library for them
+    if srcs or hdrs:
+        impl_lib_name = "_" + name + "_impl"
+        cc_library(
+            name = impl_lib_name,
+            srcs = srcs,
+            hdrs = hdrs,
+            copts = (copts or []) + ["-fPIC"],
+            defines = defines,
+            deps = ["@rules_python//python/cc:current_py_cc_headers"],
+            visibility = ["//visibility:private"],
+        )
+        csl_deps.append(":" + impl_lib_name)
+
+    # 3. If no static deps or sources were specified, use empty target for CSL requirement
+    if not csl_deps:
+        csl_deps.append("//python/private/cc:empty")
+
+    # 4. Create the underlying cc_shared_library
+    csl_name = "_" + name + "_csl"
+    csl_kwargs = {}
+    if exports_filter:
+        csl_kwargs["exports_filter"] = exports_filter
+    if user_link_flags:
+        csl_kwargs["user_link_flags"] = user_link_flags
+
+    cc_shared_library(
+        name = csl_name,
+        deps = csl_deps,
+        dynamic_deps = dynamic_deps,
+        visibility = ["//visibility:private"],
+        **csl_kwargs
+    )
+
+    # 5. Select default libc constraint if not provided
+    if "libc" not in kwargs:
+        kwargs["libc"] = select({
+            "@rules_python//python/config_settings:_is_py_linux_libc_glibc": "glibc",
+            "@rules_python//python/config_settings:_is_py_linux_libc_musl": "musl",
+            "//conditions:default": "glibc",
+        })
+
+    if data != None:
+        kwargs["data"] = data
+
+    # 6. Wrap with py_extension_wrapper for PEP 3149 naming & PyInfo
+    py_extension_wrapper(
+        name = name,
+        src = ":" + csl_name,
+        visibility = visibility,
+        os = select({
+            "@platforms//os:linux": "linux",
+            "@platforms//os:macos": "macos",
+            "@platforms//os:windows": "windows",
+            "//conditions:default": "unknown",
+        }),
+        cpu = select({
+            "@platforms//cpu:x86_64": "x86_64",
+            "@platforms//cpu:aarch64": "aarch64",
+            "@platforms//cpu:x86_32": "x86_32",
+            "//conditions:default": "unknown",
+        }),
+        **kwargs
+    )
diff --git a/python/private/cc/py_extension_rule.bzl b/python/private/cc/py_extension_rule.bzl
new file mode 100644
index 0000000000..744d090c09
--- /dev/null
+++ b/python/private/cc/py_extension_rule.bzl
@@ -0,0 +1,158 @@
+"""Implementation of the _py_extension_wrapper rule."""
+
+load("@rules_cc//cc/common:cc_shared_library_info.bzl", "CcSharedLibraryInfo")
+load("//python:versions.bzl", "PLATFORMS")
+load("//python/private:attr_builders.bzl", "attrb")
+load("//python/private:attributes.bzl", "COMMON_ATTRS")
+load("//python/private:builders.bzl", "builders")
+load("//python/private:py_info.bzl", "PyInfo")
+load("//python/private:rule_builders.bzl", "ruleb")
+load("//python/private:toolchain_types.bzl", "PY_CC_TOOLCHAIN_TYPE")
+
+def _py_extension_wrapper_impl(ctx):
+    module_name = ctx.attr.module_name or ctx.label.name
+    repo_name = ctx.label.workspace_name or ctx.workspace_name
+    import_path = repo_name
+    if ctx.label.package:
+        import_path = repo_name + "/" + ctx.label.package
+
+    cc_toolchain = ctx.toolchains["@bazel_tools//tools/cpp:toolchain_type"].cc
+    ext = _get_extension(cc_toolchain)
+    use_py_limited_api = bool(ctx.attr.py_limited_api)
+    if use_py_limited_api:
+        output_filename = "{module_name}.abi3.{ext}".format(
+            module_name = module_name,
+            ext = ext,
+        )
+    else:
+        py_toolchain = ctx.toolchains[PY_CC_TOOLCHAIN_TYPE]
+        py_cc_toolchain = py_toolchain.py_cc_toolchain
+        platform_tag = _get_platform(ctx)
+        output_filename = "{module_name}.{abi_tag}-{platform}.{ext}".format(
+            module_name = module_name,
+            abi_tag = py_cc_toolchain.abi_tag,
+            platform = platform_tag,
+            ext = ext,
+        )
+
+    py_dso = ctx.actions.declare_file(output_filename)
+
+    # Symlink the cc_shared_library output to the PEP 3149 / abi3 filename
+    csl_target = ctx.attr.src
+    csl_file = csl_target[DefaultInfo].files.to_list()[0]
+    ctx.actions.symlink(
+        output = py_dso,
+        target_file = csl_file,
+    )
+
+    runfiles_builder = builders.RunfilesBuilder()
+    runfiles_builder.add(py_dso)
+    runfiles_builder.add(ctx.files.data)
+    runfiles_builder.add_targets(ctx.attr.data)
+    runfiles_builder.add(csl_target[DefaultInfo].default_runfiles)
+    runfiles = runfiles_builder.build(ctx)
+
+    return [
+        DefaultInfo(
+            files = depset([py_dso]),
+            runfiles = runfiles,
+        ),
+        PyInfo(
+            transitive_sources = depset([py_dso]),
+            imports = depset([import_path]),
+        ),
+    ]
+
+PY_EXTENSION_WRAPPER_ATTRS = COMMON_ATTRS | {
+    "libc": lambda: attrb.String(default = "glibc"),
+    "module_name": lambda: attrb.String(),
+    "py_limited_api": lambda: attrb.String(
+        default = "",
+    ),
+    "src": lambda: attrb.Label(
+        mandatory = True,
+        providers = [CcSharedLibraryInfo],
+        doc = "The cc_shared_library target to wrap.",
+    ),
+    "os": lambda: attrb.String(doc = "OS determined by macro select."),
+    "cpu": lambda: attrb.String(doc = "CPU determined by macro select."),
+}
+
+def create_py_extension_wrapper_rule_builder(**kwargs):
+    """Create a rule builder for the wrapper."""
+    builder = ruleb.Rule(
+        implementation = _py_extension_wrapper_impl,
+        attrs = PY_EXTENSION_WRAPPER_ATTRS,
+        provides = [PyInfo],
+        toolchains = [
+            ruleb.ToolchainType(PY_CC_TOOLCHAIN_TYPE),
+            ruleb.ToolchainType("@bazel_tools//tools/cpp:toolchain_type"),
+        ],
+        fragments = ["cpp"],
+        **kwargs
+    )
+    return builder
+
+py_extension_wrapper = create_py_extension_wrapper_rule_builder().build()
+
+def _get_extension(cc_toolchain):
+    """
+    Derives the appropriate file extension from the C++ toolchain.
+
+    Args:
+        cc_toolchain: The CcToolchainInfo provider (usually obtained via
+          ctx.toolchains["@bazel_tools//tools/cpp:toolchain_type"].cc)
+
+    Returns:
+        The extension, e.g. "so" or "pyd"
+    """
+
+    # Windows uses .pyd; Unix (Linux/macOS) uses .so for Python modules
+    target_name = cc_toolchain.target_gnu_system_name
+    is_windows = "windows" in target_name or "mingw" in target_name or "msvc" in target_name
+    ext = "pyd" if is_windows else "so"
+    return ext
+
+def _get_platform(ctx):
+    """Derives the PEP 3149 platform tag from the target constraints.
+    Linux platform tags are standardized here:
+      - https://peps.python.org/pep-3149/
+    Windows platform tags, such as they are, are defined in this issue and
+            commit (treated as a de facto standard):
+      - https://github.com/python/cpython/issues/67169
+      - https://github.com/python/cpython/commit/03a144bb6ac3d7631a3bdb895e2a1f2d021fb08b
+    Apple platform tag is always just "darwin", discussed briefly here:
+      - https://github.com/python/cpython/commit/3b8124884c3655b4cf2629d741b18c1a38181805
+
+    Args:
+        ctx: The rule context.
+
+    Returns:
+        The platform tag, e.g. "x86_64-linux-gnu" or "win_amd64"
+    """
+    os = ctx.attr.os
+    cpu = ctx.attr.cpu
+
+    if os == "windows":
+        if cpu == "x86_64":
+            return "win_amd64"
+        if cpu == "aarch64":
+            return "win_arm64"
+        return "win32"
+    if os == "macos":
+        return "darwin"
+    if os == "linux":
+        libc = "gnu"
+        if ctx.attr.libc == "musl":
+            libc = "musl"
+        return '{}-{}-{}'.format(cpu, os, libc)
+
+    fail(
+        """
+ERROR: Unsupported target platform for {self}.
+  The target platform's constraints do not match any supported platform
+  in rules_python's central registry (python/versions.bzl).
+  Please ensure your target platform is configured correctly.""".format(
+            self = ctx.label,
+        ),
+    )
diff --git a/python/private/py_cc_toolchain_info.bzl b/python/private/py_cc_toolchain_info.bzl
index 8cb3680b59..da7938503f 100644
--- a/python/private/py_cc_toolchain_info.bzl
+++ b/python/private/py_cc_toolchain_info.bzl
@@ -17,6 +17,11 @@
 PyCcToolchainInfo = provider(
     doc = "C/C++ information about the Python runtime.",
     fields = {
+        "abi_tag": """\
+:type: str
+
+The ABI tag for extension modules, e.g. 'cpython-311' or 'cpython-313t'.
+""",
         "headers": """\
 :type: struct
 
diff --git a/python/private/py_cc_toolchain_rule.bzl b/python/private/py_cc_toolchain_rule.bzl
index b5c997ea6e..4067df668d 100644
--- a/python/private/py_cc_toolchain_rule.bzl
+++ b/python/private/py_cc_toolchain_rule.bzl
@@ -45,7 +45,14 @@ def _py_cc_toolchain_impl(ctx):
     else:
         headers_abi3 = None
 
+    abi_tag = ctx.attr.abi_tag
+    if not abi_tag:
+        # Derive default: cpython-XX
+        version_parts = ctx.attr.python_version.split(".")
+        abi_tag = "cpython-{}{}".format(version_parts[0], version_parts[1])
+
     py_cc_toolchain = PyCcToolchainInfo(
+        abi_tag = abi_tag,
         headers = struct(
             providers_map = {
                 "CcInfo": ctx.attr.headers[CcInfo],
@@ -67,6 +74,10 @@ def _py_cc_toolchain_impl(ctx):
 py_cc_toolchain = rule(
     implementation = _py_cc_toolchain_impl,
     attrs = {
+        "abi_tag": attr.string(
+            doc = "The ABI tag for extension modules, e.g. 'cpython-311'",
+            default = "",
+        ),
         "headers": attr.label(
             doc = ("Target that provides the Python headers. Typically this " +
                    "is a cc_library target."),
diff --git a/tests/cc/py_extension/BUILD.bazel b/tests/cc/py_extension/BUILD.bazel
new file mode 100644
index 0000000000..3903d30537
--- /dev/null
+++ b/tests/cc/py_extension/BUILD.bazel
@@ -0,0 +1,165 @@
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("@rules_cc//cc:cc_shared_library.bzl", "cc_shared_library")
+load("//python:py_test.bzl", "py_test")
+
+# buildifier: disable=bzl-visibility
+load("//python/cc:py_extension.bzl", "py_extension")
+load(":dependency_graph_tests.bzl", "dependency_graph_test_suite")
+load(":py_extension_tests.bzl", "py_extension_analysis_test_suite")
+load(":py_limited_api_tests.bzl", "py_limited_api_test_suite")
+
+package(
+    default_testonly = True,
+    default_visibility = ["//visibility:private"],
+)
+
+licenses(["notice"])
+
+#####
+
+py_extension(
+    # An extension defined solely by source files, with no deps
+    name = "ext_source",
+    srcs = ["ext_source.c"],
+)
+
+#####
+
+py_extension(
+    # A python extension that gets its code from a statically-linked library
+    name = "ext_static",
+    deps = [":static_dep"],
+)
+
+cc_library(
+    name = "static_dep",
+    srcs = ["static_dep.c"],
+    hdrs = ["static_dep.h"],
+)
+
+#####
+
+py_extension(
+    # An extension that also depends on a data file
+    name = "ext_with_data",
+    data = ["some_data.txt"],
+    deps = [":static_dep"],
+)
+
+#####
+
+py_extension(
+    # A python extension that dynamically links to another shared library
+    name = "ext_shared",
+    dynamic_deps = [
+        ":add_one_shared",
+    ],
+    deps = [
+        #
+        ":ext_shared_impl",
+    ],
+)
+
+cc_library(
+    name = "ext_shared_impl",
+    srcs = ["ext_shared.c"],
+    copts = [
+        # Gemini says PIC is needed
+        "-fPIC",
+        "-fvisibility=hidden",
+    ],
+    deps = [
+        #":add_one_headers",
+        # todo: if we put this here, we statically link add_one into the
+        # extension.
+        ":add_one_impl",
+        "@rules_python//python/cc:current_py_cc_headers",
+    ],
+)
+
+cc_shared_library(
+    name = "add_one_shared",
+    deps = [":add_one_impl"],
+)
+
+cc_library(
+    name = "add_one_headers",
+    hdrs = ["add_one.h"],
+)
+
+cc_library(
+    name = "add_one_impl",
+    srcs = ["add_one.c"],
+    deps = [
+        ":add_one_headers",
+        ":add_one_helper",
+    ],
+)
+
+cc_library(
+    name = "add_one_helper",
+    srcs = ["add_one_helper.c"],
+    hdrs = ["add_one_helper.h"],
+)
+
+#####
+
+py_extension(
+    # An extension that uses the Python limited API
+    name = "ext_limited",
+    py_limited_api = "3.8",
+    deps = [":ext_limited_impl"],
+)
+
+cc_library(
+    name = "ext_limited_impl",
+    srcs = ["ext_limited.c"],
+    copts = [
+        "-fPIC",
+        "-fvisibility=hidden",
+    ],
+    defines = ["Py_LIMITED_API=0x3080000"],
+    deps = [
+        "@rules_python//python/cc:current_py_cc_headers",
+    ],
+)
+
+#####
+
+py_extension(
+    # An extension with its PyInit_* function in a static dependency
+    name = "ext_init_in_dep",
+    deps = [":ext_init_in_dep_impl"],
+)
+
+cc_library(
+    name = "ext_init_in_dep_impl",
+    srcs = ["ext_init_in_dep.c"],
+    deps = [
+        "@rules_python//python/cc:current_py_cc_headers",
+    ],
+)
+
+#####
+
+py_test(
+    name = "py_extension_test",
+    srcs = ["py_extension_test.py"],
+    deps = [
+        ":ext_shared",
+        "@dev_pip//pyelftools",
+        "@rules_python//python/runfiles",
+    ],
+)
+
+py_extension_analysis_test_suite(
+    name = "py_extension_analysis_tests",
+)
+
+py_limited_api_test_suite(
+    name = "py_limited_api_tests",
+)
+
+dependency_graph_test_suite(
+    name = "dependency_graph_tests",
+)
diff --git a/tests/cc/py_extension/add_one.c b/tests/cc/py_extension/add_one.c
new file mode 100644
index 0000000000..7da8f6796e
--- /dev/null
+++ b/tests/cc/py_extension/add_one.c
@@ -0,0 +1,7 @@
+
+#include "add_one_helper.h"
+
+int add_one(int x) {
+    x = add_one_helper(x);
+    return x + 1;
+}
diff --git a/tests/cc/py_extension/add_one.h b/tests/cc/py_extension/add_one.h
new file mode 100644
index 0000000000..eda0abf7e5
--- /dev/null
+++ b/tests/cc/py_extension/add_one.h
@@ -0,0 +1,6 @@
+#ifndef TESTS_CC_PY_EXTENSION_DYN_DEP_A_H_
+#define TESTS_CC_PY_EXTENSION_DYN_DEP_A_H_
+
+int add_one(int x);
+
+#endif  // TESTS_CC_PY_EXTENSION_DYN_DEP_A_H_
diff --git a/tests/cc/py_extension/add_one_helper.c b/tests/cc/py_extension/add_one_helper.c
new file mode 100644
index 0000000000..21d19a5823
--- /dev/null
+++ b/tests/cc/py_extension/add_one_helper.c
@@ -0,0 +1,7 @@
+
+
+#include "add_one_helper.h"
+
+int add_one_helper(int i) {
+  return i + 1;
+}
diff --git a/tests/cc/py_extension/add_one_helper.h b/tests/cc/py_extension/add_one_helper.h
new file mode 100644
index 0000000000..5524d3077f
--- /dev/null
+++ b/tests/cc/py_extension/add_one_helper.h
@@ -0,0 +1,2 @@
+
+int add_one_helper(int i);
diff --git a/tests/cc/py_extension/dependency_graph_tests.bzl b/tests/cc/py_extension/dependency_graph_tests.bzl
new file mode 100644
index 0000000000..497571e128
--- /dev/null
+++ b/tests/cc/py_extension/dependency_graph_tests.bzl
@@ -0,0 +1,236 @@
+# Copyright 2025 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Parity tests comparing cc_shared_library and py_extension behavior."""
+
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("@rules_cc//cc:cc_shared_library.bzl", "cc_shared_library")
+load("@rules_cc//cc/common:cc_shared_library_info.bzl", "CcSharedLibraryInfo")
+load("@rules_testing//lib:analysis_test.bzl", "analysis_test", "test_suite")
+load("@rules_testing//lib:util.bzl", "util")
+
+# For tests 1 and 2
+def _create_dynamic_deps_helpers(name):
+    util.helper_target(
+        cc_library,
+        name = name + "_libC",
+        srcs = ["test_lib_c.c"],
+        hdrs = ["test_symbols.h"],
+        copts = ["-fPIC"],
+    )
+    util.helper_target(
+        cc_shared_library,
+        name = name + "_cslC",
+        deps = [":" + name + "_libC"],
+    )
+    util.helper_target(
+        cc_library,
+        name = name + "_libB",
+        srcs = ["test_lib_b.c"],
+        hdrs = ["test_symbols.h"],
+        copts = ["-fPIC"],
+        deps = [":" + name + "_libC"],
+    )
+    util.helper_target(
+        cc_shared_library,
+        name = name + "_cslB",
+        deps = [":" + name + "_libB"],
+        dynamic_deps = [":" + name + "_cslC"],
+    )
+    util.helper_target(
+        cc_library,
+        name = name + "_libA",
+        srcs = ["test_lib_a.c"],
+        hdrs = ["test_symbols.h"],
+        copts = ["-fPIC"],
+        deps = [":" + name + "_libB", ":" + name + "_libC"],
+    )
+
+# Test 1: CSL A -> CSL B -> CSL C (Dynamic deps)
+def _test_csl_dynamic_deps_top(name):
+    _create_dynamic_deps_helpers(name)
+    util.helper_target(
+        cc_shared_library,
+        name = name + "_cslA",
+        deps = [":" + name + "_libA"],
+        dynamic_deps = [":" + name + "_cslB", ":" + name + "_cslC"],
+    )
+    analysis_test(
+        name = name,
+        target = name + "_cslA",
+        impl = _csl_dynamic_deps_test_impl,
+    )
+
+def _csl_dynamic_deps_test_impl(env, target):
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+    csl_info = target[CcSharedLibraryInfo]
+
+    # Derive labels
+    test_name = target.label.name[:-5]  # remove "_cslA"
+    lib_a_label = target.label.same_package_label(test_name + "_libA")
+    lib_b_label = target.label.same_package_label(test_name + "_libB")
+    lib_c_label = target.label.same_package_label(test_name + "_libC")
+
+    env.expect.that_collection([str(e) for e in csl_info.exports]).contains_exactly([str(lib_a_label)])
+    if hasattr(csl_info, "link_once_static_libs"):
+        static_libs = [str(lbl) for lbl in csl_info.link_once_static_libs]
+        env.expect.that_collection(static_libs).contains(str(lib_a_label))
+        env.expect.that_collection(static_libs).contains_none_of([str(lib_b_label), str(lib_c_label)])
+
+# Test 2: py_extension A -> CSL B -> CSL C (Dynamic deps)
+def _test_pyext_dynamic_deps_cslB(name):
+    _create_dynamic_deps_helpers(name)
+    analysis_test(
+        name = name,
+        target = name + "_cslB",
+        impl = _cslB_deps_test_impl,
+    )
+
+def _test_pyext_dynamic_deps_cslC(name):
+    _create_dynamic_deps_helpers(name)
+    analysis_test(
+        name = name,
+        target = name + "_cslC",
+        impl = _cslC_deps_test_impl,
+    )
+
+def _cslC_deps_test_impl(env, target):
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+    csl_info = target[CcSharedLibraryInfo]
+
+    # Derive labels
+    test_name = target.label.name[:-5]  # remove "_cslC"
+    lib_c_label = target.label.same_package_label(test_name + "_libC")
+
+    env.expect.that_collection([str(e) for e in csl_info.exports]).contains_exactly([str(lib_c_label)])
+    if hasattr(csl_info, "link_once_static_libs"):
+        env.expect.that_collection([str(lbl) for lbl in csl_info.link_once_static_libs]).contains_exactly([str(lib_c_label)])
+
+def _cslB_deps_test_impl(env, target):
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+    csl_info = target[CcSharedLibraryInfo]
+
+    # Derive labels
+    test_name = target.label.name[:-5]  # remove "_cslB"
+    lib_b_label = target.label.same_package_label(test_name + "_libB")
+    lib_c_label = target.label.same_package_label(test_name + "_libC")
+    csl_c_label = target.label.same_package_label(test_name + "_cslC")
+
+    env.expect.that_collection([str(e) for e in csl_info.exports]).contains_exactly([str(lib_b_label)])
+    if hasattr(csl_info, "link_once_static_libs"):
+        static_libs = [str(lbl) for lbl in csl_info.link_once_static_libs]
+        env.expect.that_collection(static_libs).contains(str(lib_b_label))
+        env.expect.that_collection(static_libs).contains_none_of([str(lib_c_label)])
+
+    if hasattr(csl_info, "dynamic_deps"):
+        dynamic_deps = [str(d.linker_input.owner) for d in csl_info.dynamic_deps.to_list()]
+        env.expect.that_collection(dynamic_deps).contains(str(csl_c_label))
+
+# For tests 3 and 4
+def _create_static_sharing_helpers(name):
+    util.helper_target(
+        cc_library,
+        name = name + "_libC",
+        srcs = ["test_lib_c.c"],
+        hdrs = ["test_symbols.h"],
+        copts = ["-fPIC"],
+    )
+    util.helper_target(
+        cc_library,
+        name = name + "_libB",
+        srcs = ["test_lib_b.c"],
+        hdrs = ["test_symbols.h"],
+        copts = ["-fPIC"],
+        deps = [":" + name + "_libC"],
+    )
+    util.helper_target(
+        cc_shared_library,
+        name = name + "_cslB",
+        deps = [":" + name + "_libB", ":" + name + "_libC"],
+    )
+    util.helper_target(
+        cc_library,
+        name = name + "_libA",
+        srcs = ["test_lib_a.c"],
+        hdrs = ["test_symbols.h"],
+        copts = ["-fPIC"],
+        deps = [":" + name + "_libB", ":" + name + "_libC"],
+    )
+
+# Test 3: CSL A -> CSL B, CL C (Static sharing)
+def _test_csl_static_sharing_top(name):
+    _create_static_sharing_helpers(name)
+    util.helper_target(
+        cc_shared_library,
+        name = name + "_cslA",
+        deps = [":" + name + "_libA"],
+        dynamic_deps = [":" + name + "_cslB"],
+    )
+    analysis_test(
+        name = name,
+        target = name + "_cslA",
+        impl = _csl_static_sharing_test_impl,
+    )
+
+def _csl_static_sharing_test_impl(env, target):
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+    csl_info = target[CcSharedLibraryInfo]
+
+    # Derive labels
+    test_name = target.label.name[:-5]  # remove "_cslA"
+    lib_a_label = target.label.same_package_label(test_name + "_libA")
+    lib_b_label = target.label.same_package_label(test_name + "_libB")
+    lib_c_label = target.label.same_package_label(test_name + "_libC")
+
+    env.expect.that_collection([str(e) for e in csl_info.exports]).contains_exactly([str(lib_a_label)])
+    if hasattr(csl_info, "link_once_static_libs"):
+        static_libs = [str(lbl) for lbl in csl_info.link_once_static_libs]
+        env.expect.that_collection(static_libs).contains(str(lib_a_label))
+        env.expect.that_collection(static_libs).contains_none_of([str(lib_b_label), str(lib_c_label)])
+
+# Test 4: Same as 3, but A is py_extension
+
+def _test_pyext_static_sharing_cslB(name):
+    _create_static_sharing_helpers(name)
+    analysis_test(
+        name = name,
+        target = name + "_cslB",
+        impl = _cslB_static_sharing_test_impl,
+    )
+
+def _cslB_static_sharing_test_impl(env, target):
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+    csl_info = target[CcSharedLibraryInfo]
+
+    # Derive labels
+    test_name = target.label.name[:-5]  # remove "_cslB"
+    lib_b_label = target.label.same_package_label(test_name + "_libB")
+    lib_c_label = target.label.same_package_label(test_name + "_libC")
+
+    env.expect.that_collection([str(e) for e in csl_info.exports]).contains_exactly([str(lib_b_label), str(lib_c_label)])
+    if hasattr(csl_info, "link_once_static_libs"):
+        static_libs = [str(lbl) for lbl in csl_info.link_once_static_libs]
+        env.expect.that_collection(static_libs).contains_exactly([str(lib_b_label), str(lib_c_label)])
+
+def dependency_graph_test_suite(name):
+    test_suite(
+        name = name,
+        tests = [
+            _test_csl_dynamic_deps_top,
+            _test_pyext_dynamic_deps_cslB,
+            _test_pyext_dynamic_deps_cslC,
+            _test_csl_static_sharing_top,
+            _test_pyext_static_sharing_cslB,
+        ],
+    )
diff --git a/tests/cc/py_extension/ext_init_in_dep.c b/tests/cc/py_extension/ext_init_in_dep.c
new file mode 100644
index 0000000000..a6d32ba0b2
--- /dev/null
+++ b/tests/cc/py_extension/ext_init_in_dep.c
@@ -0,0 +1,20 @@
+
+#include <Python.h>
+
+// No methods defined; we're just testing the init function.
+static PyMethodDef ModuleMethods[] = {
+    {NULL, NULL, 0, NULL}        /* Sentinel */
+};
+
+static struct PyModuleDef ext_init_in_dep_module = {
+    PyModuleDef_HEAD_INIT,
+    "ext_init_in_dep",   /* name of module */
+    NULL, /* module documentation, may be NULL */
+    -1,       /* size of per-interpreter state of the module,
+                 or -1 if the module keeps state in global variables. */
+    ModuleMethods
+};
+
+PyMODINIT_FUNC PyInit_ext_init_in_dep(void) {
+    return PyModule_Create(&ext_init_in_dep_module);
+}
diff --git a/tests/cc/py_extension/ext_limited.c b/tests/cc/py_extension/ext_limited.c
new file mode 100644
index 0000000000..f3622c5824
--- /dev/null
+++ b/tests/cc/py_extension/ext_limited.c
@@ -0,0 +1,22 @@
+#include <Python.h>
+
+static PyObject* get_limited_api_version(PyObject* self, PyObject* args) {
+    return PyUnicode_FromFormat("0x%08x", Py_LIMITED_API);
+}
+
+static PyMethodDef ModuleMethods[] = {
+    {"get_limited_api_version", get_limited_api_version, METH_NOARGS, "Get the version of the limited API this extension was compiled against."},
+    {NULL, NULL, 0, NULL}
+};
+
+static struct PyModuleDef ext_limited_module = {
+    PyModuleDef_HEAD_INIT,
+    "ext_limited",
+    NULL,
+    -1,
+    ModuleMethods
+};
+
+PyMODINIT_FUNC PyInit_ext_limited(void) {
+    return PyModule_Create(&ext_limited_module);
+}
diff --git a/tests/cc/py_extension/ext_shared.c b/tests/cc/py_extension/ext_shared.c
new file mode 100644
index 0000000000..4b79a6da2f
--- /dev/null
+++ b/tests/cc/py_extension/ext_shared.c
@@ -0,0 +1,33 @@
+#include <Python.h>
+
+#include "tests/cc/py_extension/add_one.h"
+
+// A simple function that returns a Python integer.
+static PyObject* do_alpha(PyObject* self, PyObject* args) {
+    return PyLong_FromLong(add_one(41));
+}
+
+// Method definition object for this extension, these are the functions
+// that will be available in the module.
+static PyMethodDef ModuleMethods[] = {
+    {"do_alpha", do_alpha, METH_NOARGS, "A simple C function."},
+    {NULL, NULL, 0, NULL}        /* Sentinel */
+};
+
+// Module definition
+// The arguments of this structure tell Python what to call your extension,
+// what its methods are and where to look for its method definitions.
+static struct PyModuleDef ext_shared_module = {
+    PyModuleDef_HEAD_INIT,
+    "ext_shared",   /* name of module */
+    NULL, /* module documentation, may be NULL */
+    -1,       /* size of per-interpreter state of the module,
+                 or -1 if the module keeps state in global variables. */
+    ModuleMethods
+};
+
+// The module init function. This must be exported and retained in the
+// shared library output.
+PyMODINIT_FUNC PyInit_ext_shared(void) {
+    return PyModule_Create(&ext_shared_module);
+}
diff --git a/tests/cc/py_extension/ext_source.c b/tests/cc/py_extension/ext_source.c
new file mode 100644
index 0000000000..df0239df3a
--- /dev/null
+++ b/tests/cc/py_extension/ext_source.c
@@ -0,0 +1,33 @@
+
+#include <Python.h>
+
+
+static PyObject* calc_one_plus_two(PyObject* self, PyObject* args) {
+    return PyLong_FromLong(1 + 2);
+}
+
+
+// Method definition object for this extension, these are the functions
+// that will be available in the module.
+static PyMethodDef ModuleMethods[] = {
+    {"calc_one_plus_two", calc_one_plus_two, METH_NOARGS, "A simple C function."},
+    {NULL, NULL, 0, NULL}        /* Sentinel */
+};
+
+// Module definition
+// The arguments of this structure tell Python what to call your extension,
+// what its methods are and where to look for its method definitions.
+static struct PyModuleDef ext_source_module = {
+    PyModuleDef_HEAD_INIT,
+    "ext_source",   /* name of module */
+    NULL, /* module documentation, may be NULL */
+    -1,       /* size of per-interpreter state of the module,
+                 or -1 if the module keeps state in global variables. */
+    ModuleMethods
+};
+
+// The module init function. This must be exported and retained in the
+// shared library output.
+PyMODINIT_FUNC PyInit_ext_source(void) {
+    return PyModule_Create(&ext_source_module);
+}
diff --git a/tests/cc/py_extension/ext_static.c b/tests/cc/py_extension/ext_static.c
new file mode 100644
index 0000000000..500c52db00
--- /dev/null
+++ b/tests/cc/py_extension/ext_static.c
@@ -0,0 +1 @@
+/* A no-op C extension for static linking tests. */
diff --git a/tests/cc/py_extension/py_extension_test.py b/tests/cc/py_extension/py_extension_test.py
new file mode 100644
index 0000000000..52d5502ea7
--- /dev/null
+++ b/tests/cc/py_extension/py_extension_test.py
@@ -0,0 +1,49 @@
+import os
+import unittest
+
+import ext_shared
+from elftools.elf.dynamic import DynamicSection
+from elftools.elf.elffile import ELFFile
+
+from python.runfiles import runfiles
+
+
+class PyExtensionTest(unittest.TestCase):
+    def test_inspect_elf(self):
+        r = runfiles.Create()
+        ext_path = r.Rlocation(
+            "rules_python/tests/cc/py_extension/"
+            + "ext_shared.cpython-311-x86_64-linux-gnu.so"
+        )
+        self.assertTrue(
+            os.path.exists(ext_path), f"Could not find ext_shared.so at {ext_path}"
+        )
+
+        with open(ext_path, "rb") as f:
+            elf = ELFFile(f)
+
+            # Check for DT_NEEDED entry for the dynamic library
+            dynamic_section = elf.get_section_by_name(".dynamic")
+            self.assertIsNotNone(dynamic_section)
+            self.assertTrue(isinstance(dynamic_section, DynamicSection))
+
+            needed_libs = [
+                tag.needed
+                for tag in dynamic_section.iter_tags()
+                if tag.entry.d_tag == "DT_NEEDED"
+            ]
+            self.assertIn("libadd_one_shared.so", needed_libs)
+
+            # Check for the PyInit symbol
+            dynsym_section = elf.get_section_by_name(".dynsym")
+            self.assertIsNotNone(dynsym_section)
+
+            symbols = [s.name for s in dynsym_section.iter_symbols()]
+            self.assertIn("PyInit_ext_shared", symbols)
+
+    def test_import_and_call(self):
+        self.assertEqual(ext_shared.do_alpha(), 43)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/cc/py_extension/py_extension_tests.bzl b/tests/cc/py_extension/py_extension_tests.bzl
new file mode 100644
index 0000000000..13fb4e9e0c
--- /dev/null
+++ b/tests/cc/py_extension/py_extension_tests.bzl
@@ -0,0 +1,109 @@
+# Copyright 2025 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Tests for py_extension."""
+
+load("@rules_cc//cc/common:cc_shared_library_info.bzl", "CcSharedLibraryInfo")
+load("@rules_testing//lib:analysis_test.bzl", "analysis_test", "test_suite")
+load("@rules_testing//lib:truth.bzl", "matching")
+load("//python/private:py_info.bzl", "PyInfo")  # buildifier: disable=bzl-visibility
+
+_tests = []
+
+def _test_static_deps_impl(env, target):
+    env.expect.that_target(target).has_provider(PyInfo)
+    py_info = target[PyInfo]
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+
+    # The .so should be in PyInfo
+    env.expect.that_collection(py_info.transitive_sources.to_list()).has_size(1)
+    env.expect.that_depset_of_files(py_info.transitive_sources).contains_predicate(
+        matching.file_basename_equals("ext_static.cpython-311-x86_64-linux-gnu.so"),
+    )
+
+def _test_static_deps(name):
+    analysis_test(
+        name = name,
+        impl = _test_static_deps_impl,
+        target = "//tests/cc/py_extension:ext_static",
+    )
+
+_tests.append(_test_static_deps)
+
+def _test_data_deps_impl(env, target):
+    env.expect.that_target(target).has_provider(PyInfo)
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+
+    # Check that data file is in runfiles
+    default_info = target[DefaultInfo]
+    env.expect.that_depset_of_files(default_info.default_runfiles.files).contains_predicate(
+        matching.file_basename_equals("test_symbols.h"),
+    )
+
+def _test_data_deps(name):
+    analysis_test(
+        name = name,
+        impl = _test_data_deps_impl,
+        target = "//tests/cc/py_extension:ext_with_data",
+    )
+
+_tests.append(_test_data_deps)
+
+def _test_dynamic_deps_impl(env, target):
+    env.expect.that_target(target).has_provider(PyInfo)
+    py_info = target[PyInfo]
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+
+    # The .so should be in PyInfo
+    env.expect.that_collection(py_info.transitive_sources.to_list()).has_size(1)
+    env.expect.that_depset_of_files(py_info.transitive_sources).contains_predicate(
+        matching.file_basename_equals("ext_shared.cpython-311-x86_64-linux-gnu.so"),
+    )
+
+    # CcSharedLibraryInfo provider should be present and non-empty
+    env.expect.that_target(target).has_provider(CcSharedLibraryInfo)
+
+def _test_dynamic_deps(name):
+    analysis_test(
+        name = name,
+        impl = _test_dynamic_deps_impl,
+        target = "//tests/cc/py_extension:ext_shared",
+    )
+
+_tests.append(_test_dynamic_deps)
+
+def _test_musl_platform_impl(env, target):
+    env.expect.that_target(target).has_provider(PyInfo)
+    py_info = target[PyInfo]
+    env.expect.that_depset_of_files(py_info.transitive_sources).contains_predicate(
+        matching.file_basename_equals("ext_static.cpython-311-x86_64-linux-musl.so"),
+    )
+
+def _test_musl_platform(name):
+    analysis_test(
+        name = name,
+        impl = _test_musl_platform_impl,
+        target = "//tests/cc/py_extension:ext_static",
+        config_settings = {
+            str(Label("//python/config_settings:py_linux_libc")): "musl",
+        },
+    )
+
+_tests.append(_test_musl_platform)
+
+def py_extension_analysis_test_suite(name):
+    test_suite(
+        name = name,
+        tests = _tests,
+    )
diff --git a/tests/cc/py_extension/py_limited_api_tests.bzl b/tests/cc/py_extension/py_limited_api_tests.bzl
new file mode 100644
index 0000000000..a59628c19c
--- /dev/null
+++ b/tests/cc/py_extension/py_limited_api_tests.bzl
@@ -0,0 +1,139 @@
+# Copyright 2025 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Tests for the py_limited_api attribute for py_extension."""
+
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("@rules_testing//lib:analysis_test.bzl", "analysis_test", "test_suite")
+load("@rules_testing//lib:util.bzl", "util")
+load("//python/cc:py_extension.bzl", "py_extension")
+
+def _test_limited_pass_impl(env, target):
+    env.expect.that_target(target).default_outputs().contains(
+        "tests/cc/py_extension/{}.abi3.so".format(target.label.name),
+    )
+
+def _test_limited_same_version(name):
+    util.helper_target(
+        cc_library,
+        name = name + "_csl",
+        defines = ["Py_LIMITED_API=0x03080000"],
+        deps = [
+            "@rules_python//python/cc:current_py_cc_headers",
+        ],
+    )
+    py_extension(
+        name = name + "_pyext",
+        deps = [":" + name + "_csl"],
+        py_limited_api = "3.8",
+    )
+    analysis_test(
+        name = name,
+        target = name + "_pyext",
+        impl = _test_limited_pass_impl,
+    )
+
+def _test_limited_older_dep(name):
+    util.helper_target(
+        cc_library,
+        name = name + "_csl",
+        defines = ["Py_LIMITED_API=0x03080000"],  # 3.8
+        deps = [
+            "@rules_python//python/cc:current_py_cc_headers",
+        ],
+    )
+    py_extension(
+        name = name + "_pyext",
+        deps = [":" + name + "_csl"],
+        py_limited_api = "3.9",  # 3.9
+    )
+    analysis_test(
+        name = name,
+        target = name + "_pyext",
+        impl = _test_limited_pass_impl,
+    )
+
+def _test_no_limited_api(name):
+    util.helper_target(
+        cc_library,
+        name = name + "_csl",
+        deps = [
+            "@rules_python//python/cc:current_py_cc_headers",
+        ],
+    )
+    py_extension(
+        name = name + "_pyext",
+        deps = [":" + name + "_csl"],
+    )
+    analysis_test(
+        name = name,
+        target = name + "_pyext",
+        impl = _test_no_limited_api_impl,
+    )
+
+def _test_no_limited_api_impl(env, target):
+    # Should pass, nothing to assert on filename since it is platform-specific
+    _ = env  # @unused
+    _ = target  # @unused
+
+def _test_no_limited_api_dep_has_limited(name):
+    util.helper_target(
+        cc_library,
+        name = name + "_csl",
+        defines = ["Py_LIMITED_API=0x03080000"],
+        deps = [
+            "@rules_python//python/cc:current_py_cc_headers",
+        ],
+    )
+    py_extension(
+        name = name + "_pyext",
+        deps = [":" + name + "_csl"],
+    )
+    analysis_test(
+        name = name,
+        target = name + "_pyext",
+        impl = _test_no_limited_api_dep_has_limited_impl,
+    )
+
+def _test_no_limited_api_dep_has_limited_impl(env, target):
+    _ = env  # @unused
+    _ = target  # @unused
+
+def _test_limited_api_dep_has_no_python(name):
+    util.helper_target(
+        cc_library,
+        name = name + "_csl",
+    )
+    py_extension(
+        name = name + "_pyext",
+        deps = [":" + name + "_csl"],
+        py_limited_api = "3.8",
+    )
+    analysis_test(
+        name = name,
+        target = name + "_pyext",
+        impl = _test_limited_pass_impl,
+    )
+
+def py_limited_api_test_suite(name):
+    test_suite(
+        name = name,
+        tests = [
+            _test_limited_same_version,
+            _test_limited_older_dep,
+            _test_no_limited_api,
+            _test_no_limited_api_dep_has_limited,
+            _test_limited_api_dep_has_no_python,
+        ],
+    )
diff --git a/tests/cc/py_extension/some_data.txt b/tests/cc/py_extension/some_data.txt
new file mode 100644
index 0000000000..4b5dc1d64c
--- /dev/null
+++ b/tests/cc/py_extension/some_data.txt
@@ -0,0 +1 @@
+This is a data file
diff --git a/tests/cc/py_extension/static_dep.c b/tests/cc/py_extension/static_dep.c
new file mode 100644
index 0000000000..fa95e4dacc
--- /dev/null
+++ b/tests/cc/py_extension/static_dep.c
@@ -0,0 +1,5 @@
+#include "static_dep.h"
+
+int my_lib_func() {
+    return 42;
+}
diff --git a/tests/cc/py_extension/static_dep.h b/tests/cc/py_extension/static_dep.h
new file mode 100644
index 0000000000..d0f272abd7
--- /dev/null
+++ b/tests/cc/py_extension/static_dep.h
@@ -0,0 +1 @@
+int my_lib_func();
diff --git a/tests/cc/py_extension/test_lib_a.c b/tests/cc/py_extension/test_lib_a.c
new file mode 100644
index 0000000000..19e2f489bf
--- /dev/null
+++ b/tests/cc/py_extension/test_lib_a.c
@@ -0,0 +1,6 @@
+#include "test_symbols.h"
+
+void fnA() {
+    fnB();
+    fnC();
+}
diff --git a/tests/cc/py_extension/test_lib_b.c b/tests/cc/py_extension/test_lib_b.c
new file mode 100644
index 0000000000..3621587c1c
--- /dev/null
+++ b/tests/cc/py_extension/test_lib_b.c
@@ -0,0 +1,5 @@
+#include "test_symbols.h"
+
+void fnB() {
+    fnC();
+}
diff --git a/tests/cc/py_extension/test_lib_c.c b/tests/cc/py_extension/test_lib_c.c
new file mode 100644
index 0000000000..99941576dd
--- /dev/null
+++ b/tests/cc/py_extension/test_lib_c.c
@@ -0,0 +1,6 @@
+#include "test_symbols.h"
+#include <stdio.h>
+
+void fnC() {
+    printf("fnC\n");
+}
diff --git a/tests/cc/py_extension/test_symbols.h b/tests/cc/py_extension/test_symbols.h
new file mode 100644
index 0000000000..59ab3b02e7
--- /dev/null
+++ b/tests/cc/py_extension/test_symbols.h
@@ -0,0 +1,8 @@
+#ifndef TEST_SYMBOLS_H
+#define TEST_SYMBOLS_H
+
+void fnC();
+void fnB();
+void fnA();
+
+#endif // TEST_SYMBOLS_H