diff --git a/python/repositories.bzl b/python/repositories.bzl
index efde00a4e7..62b45bdab6 100644
--- a/python/repositories.bzl
+++ b/python/repositories.bzl
@@ -179,6 +179,16 @@ def _python_repository_impl(rctx):
             "share/**",
         ]
 
+    python_wrapper = "python_wrapper.sh"
+    python_wrapper_content = """\
+#!/bin/bash
+
+set -o errexit -o nounset -o pipefail
+
+external/{repo_name}/{python_bin} -B -s "$@"
+""".format(repo_name = rctx.name, python_bin = python_bin)
+    rctx.file(python_wrapper, python_wrapper_content, executable = True)
+
     build_content = """\
 # Generated by python/repositories.bzl
 
@@ -235,8 +245,8 @@ exports_files(["python", "{python_path}"])
 
 py_runtime(
     name = "py3_runtime",
-    files = [":files"],
-    interpreter = "{python_path}",
+    files = [":files", "{python_wrapper}"],
+    interpreter = "{python_wrapper}",
     python_version = "PY3",
 )
 
@@ -248,10 +258,11 @@ py_runtime_pair(
 """.format(
         glob_include = repr(glob_include),
         python_path = python_bin,
+        python_wrapper = python_wrapper,
         python_version = python_short_version,
     )
     rctx.delete("python")
-    rctx.symlink(python_bin, "python")
+    rctx.symlink(python_wrapper, "python")
     rctx.file(STANDALONE_INTERPRETER_FILENAME, "# File intentionally left blank. Indicates that this is an interpreter repo created by rules_python.")
     rctx.file("BUILD.bazel", build_content)