diff --git a/.circleci/config.yml b/.circleci/config.yml
index fca0d8818..3037ba210 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -124,6 +124,12 @@ jobs:
 
     steps:
       - checkout_and_rebase
+
+      - run:
+          shell: /usr/bin/env node -e
+          command: |
+            console.error("OK")
+
       - *restore_cache
       - setup_bazel_config
       - yarn_install
diff --git a/circleci-orb/BUILD.bazel b/circleci-orb/BUILD.bazel
index a17e9965c..42f5a3aea 100644
--- a/circleci-orb/BUILD.bazel
+++ b/circleci-orb/BUILD.bazel
@@ -1,6 +1,17 @@
+load("@build_bazel_rules_nodejs//:index.bzl", "nodejs_binary")
+
 ORB_NAME = "angular/dev-infra"
 
-ORB_VERSION = "0.0.7"
+ORB_VERSION = "0.0.16"
+
+nodejs_binary(
+    name = "pack_orb_script",
+    entry_point = "pack-orb-script.mjs",
+    templated_args = [
+        "--nobazel_run_linker",
+    ],
+    visibility = ["//circleci-orb:__subpackages__"],
+)
 
 filegroup(
     name = "orb_generated_files",
diff --git a/circleci-orb/commands/rebase-pr-on-target-branch.yml b/circleci-orb/commands/rebase-pr-on-target-branch.yml
index 9168dc7ba..5a7622271 100755
--- a/circleci-orb/commands/rebase-pr-on-target-branch.yml
+++ b/circleci-orb/commands/rebase-pr-on-target-branch.yml
@@ -13,7 +13,7 @@ parameters:
     default: 'main'
   shell:
     type: string
-    default: ""
+    default: ''
     description: |
       Shell to use for executing the command. Useful for Windows where a
       non-bash shell is the default.
diff --git a/circleci-orb/index.bzl b/circleci-orb/index.bzl
index 575e11661..284bafcde 100644
--- a/circleci-orb/index.bzl
+++ b/circleci-orb/index.bzl
@@ -1,20 +1,18 @@
 """Helper rules for building CircleCI orbs with the help of Bazel."""
 
+load("@build_bazel_rules_nodejs//:index.bzl", "npm_package_bin")
+
 def nodejs_script_to_sh_script(name, output_file, bundle_file):
     """Rule that takes a NodeJS script and wraps it into a Bash script.
 
       This is useful for inclusion in CircleCI `run` commands in Orbs because
       there cannot be an external NodeJS script file, or direct NodeJS `run` commands.
     """
-    native.genrule(
+
+    npm_package_bin(
         name = name,
-        srcs = [bundle_file],
+        tool = "//circleci-orb:pack_orb_script",
+        data = [bundle_file],
         outs = [output_file],
-        cmd = """
-          touch $@
-          echo '(cat <<"EOF" ' >> $@
-          cat $< >> $@
-          echo 'EOF' >> $@
-          echo ') | node' >> $@
-        """,
+        args = ["$(location %s)" % bundle_file, "$@"],
     )
diff --git a/circleci-orb/pack-orb-script.mjs b/circleci-orb/pack-orb-script.mjs
new file mode 100644
index 000000000..5f4db993e
--- /dev/null
+++ b/circleci-orb/pack-orb-script.mjs
@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright Google LLC All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.io/license
+ */
+
+import fs from 'fs';
+
+async function main(bundleExecpath, outputExecpath) {
+  const content = await fs.promises.readFile(bundleExecpath, 'utf8');
+  // We need to avoid passing it through command line arguments. See:
+  // https://stackoverflow.com/a/47443446.
+  const output = `
+node <<"NGEOF"
+${content}
+NGEOF
+`;
+  await fs.promises.writeFile(outputExecpath, output, 'utf8');
+}
+
+try {
+  const [bundleExecpath, outputExecpath] = process.argv.slice(2);
+  await main(bundleExecpath, outputExecpath);
+} catch (e) {
+  console.error(e);
+  process.exitCode = 1;
+}
diff --git a/circleci-orb/scripts/rebase-pr-on-target-branch/BUILD.bazel b/circleci-orb/scripts/rebase-pr-on-target-branch/BUILD.bazel
index 4a42e5102..bc45bee99 100644
--- a/circleci-orb/scripts/rebase-pr-on-target-branch/BUILD.bazel
+++ b/circleci-orb/scripts/rebase-pr-on-target-branch/BUILD.bazel
@@ -6,14 +6,17 @@ package(default_visibility = ["//circleci-orb:__subpackages__"])
 ts_library(
     name = "rebase-pr-on-target-branch",
     srcs = glob(["*.ts"]),
-    deps = ["@npm//@types/node"],
+    deps = [
+        "@npm//@types/node",
+    ],
 )
 
 esbuild(
     name = "bundle",
     entry_point = "index.ts",
     format = "iife",
-    sourcemap = "inline",
+    minify = True,
+    sourcemap = "",
     deps = [":rebase-pr-on-target-branch"],
 )