diff --git a/MODULE.bazel b/MODULE.bazel
index a257c9de25ff..24658fac118f 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -28,7 +28,7 @@ bazel_dep(name = "nlohmann_json", version = "3.12.0.bcr.1", repo_name = "json")
 bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
 bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")
 bazel_dep(name = "gazelle", version = "0.50.0")
-bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
+bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.2")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 bazel_dep(name = "rules_rust", version = "0.69.0")
 bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.2")
diff --git a/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/MODULE.bazel b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/MODULE.bazel
new file mode 100644
index 000000000000..e16ab9b2e2b9
--- /dev/null
+++ b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/MODULE.bazel
@@ -0,0 +1,71 @@
+"rules_dotnet"
+
+module(
+    name = "rules_dotnet",
+    version = "0.21.5-codeql.2",
+    bazel_compatibility = [">=8.0.0"],
+    compatibility_level = 0,
+)
+
+dotnet = use_extension("@rules_dotnet//dotnet:extensions.bzl", "dotnet")
+dotnet.toolchain(dotnet_version = "10.0.100")
+dotnet.toolchain(
+    name = "dotnet_apphost",
+    dotnet_version = "10.0.100",
+)
+use_repo(dotnet, "dotnet_toolchains")
+
+# These toolchains are used to build the apphost shimmer
+use_repo(dotnet, "dotnet_apphost_x86_64-unknown-linux-gnu")
+use_repo(dotnet, "dotnet_apphost_arm64-unknown-linux-gnu")
+use_repo(dotnet, "dotnet_apphost_aarch64-apple-darwin")
+use_repo(dotnet, "dotnet_apphost_x86_64-apple-darwin")
+use_repo(dotnet, "dotnet_apphost_x86_64-pc-windows-msvc")
+use_repo(dotnet, "dotnet_apphost_arm64-pc-windows-msvc")
+
+register_toolchains("@dotnet_toolchains//:all")
+
+paket2bazel_dependencies_extension = use_extension("@rules_dotnet//dotnet:paket.paket2bazel_dependencies_extension.bzl", "paket2bazel_dependencies_extension")
+use_repo(paket2bazel_dependencies_extension, "paket.paket2bazel_dependencies")
+
+rules_dotnet_nuget_packages_extension = use_extension("@rules_dotnet//dotnet:paket.rules_dotnet_nuget_packages_extension.bzl", "rules_dotnet_nuget_packages_extension")
+use_repo(rules_dotnet_nuget_packages_extension, "paket.rules_dotnet_nuget_packages")
+
+targeting_packs_extension = use_extension("@rules_dotnet//dotnet/private/sdk/targeting_packs:dotnet.targeting_packs_extension.bzl", "targeting_packs_extension")
+use_repo(targeting_packs_extension, "dotnet.targeting_packs")
+
+runtime_packs_extension = use_extension("@rules_dotnet//dotnet/private/sdk/runtime_packs:dotnet.runtime_packs_extension.bzl", "runtime_packs_extension")
+use_repo(runtime_packs_extension, "dotnet.runtime_packs")
+
+apphost_packs_extension = use_extension("@rules_dotnet//dotnet/private/sdk/apphost_packs:dotnet.apphost_packs_extension.bzl", "apphost_packs_extension")
+use_repo(apphost_packs_extension, "dotnet.apphost_packs")
+
+bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "bazel_lib", version = "3.0.0")
+bazel_dep(name = "rules_shell", version = "0.6.1")
+
+# Dev dependencies
+bazel_dep(name = "rules_pkg", version = "1.1.0", dev_dependency = True)
+bazel_dep(name = "gazelle", version = "0.44.0", dev_dependency = True, repo_name = "bazel_gazelle")
+bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.7.1", dev_dependency = True)
+bazel_dep(name = "rules_cc", version = "0.1.2", dev_dependency = True)
+bazel_dep(name = "rules_testing", version = "0.8.0", dev_dependency = True)
+bazel_dep(name = "bazel_ci_rules", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "dotnet_test_resources_other_repo", version = "", dev_dependency = True)
+local_path_override(
+    module_name = "dotnet_test_resources_other_repo",
+    path = "dotnet/private/tests/resources/other_repo",
+)
+
+rules_dotnet_dev_nuget_packages_extension = use_extension("@rules_dotnet//dotnet:paket.rules_dotnet_dev_nuget_packages_extension.bzl", "rules_dotnet_dev_nuget_packages_extension", dev_dependency = True)
+use_repo(rules_dotnet_dev_nuget_packages_extension, "paket.rules_dotnet_dev_nuget_packages")
+
+rules_dotnet_nuget_resource_assemblies_tests_extension = use_extension("@rules_dotnet//dotnet:paket.rules_dotnet_nuget_resource_assemblies_tests_extension.bzl", "rules_dotnet_nuget_resource_assemblies_tests_extension", dev_dependency = True)
+use_repo(rules_dotnet_nuget_resource_assemblies_tests_extension, "paket.rules_dotnet_nuget_resource_assemblies_tests")
+
+internal_dev_deps = use_extension("@rules_dotnet//dotnet:internal_dev_deps.bzl", "internal_dev_deps", dev_dependency = True)
+use_repo(internal_dev_deps, "buildkite_config")
+
+rules_dotnet_nuget_tool_tests_extension = use_extension("@rules_dotnet//dotnet:paket.rules_dotnet_nuget_tool_tests_extension.bzl", "rules_dotnet_nuget_tool_tests_extension", dev_dependency = True)
+use_repo(rules_dotnet_nuget_tool_tests_extension, "paket.rules_dotnet_nuget_tool_tests")
diff --git a/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/patches/gate_rid_specific_tfm_groups.patch b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/patches/gate_rid_specific_tfm_groups.patch
new file mode 100644
index 000000000000..d1d87a3bdda8
--- /dev/null
+++ b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/patches/gate_rid_specific_tfm_groups.patch
@@ -0,0 +1,46 @@
+`tfm_filegroup` binds a TFM to a RID without gating on it in two cases:
+
+* when a TFM maps to a single RID the alias points straight at that RID's files, so
+  e.g. `Microsoft.Management.Infrastructure.Runtime.Unix` is published for every RID.
+  Its `Microsoft.Management.Infrastructure.dll` then collides with the lowercase
+  `microsoft.management.infrastructure.dll` from `...Runtime.Win` on case-insensitive
+  filesystems. Route these through the same `select` as the multi-RID case.
+* when a TFM only has RIDs and no compatible sibling the `select` has no
+  `//conditions:default`, which fails analysis on every other platform.
+  `rid_filegroup` already resolves to an empty list in that situation; do the same here.
+
+--- a/dotnet/private/rules/nuget/nuget_archive.bzl
++++ b/dotnet/private/rules/nuget/nuget_archive.bzl
+@@ -621,15 +621,10 @@
+     # that are incompatible with the current configuration
+     tfm_target_mapping = {}
+     for (tfm, rids) in tfm_rids.items():
+-        if len(rids) == 1:
+-            actual = None
+-            if rids[0] == "default":
+-                actual = "%s_%s_files" % (name, tfm)
+-            else:
+-                actual = "%s_%s_%s_files" % (name, tfm, rids[0])
++        if len(rids) == 1 and rids[0] == "default":
+             native.alias(
+                 name = "%s_%s_alias" % (name, tfm),
+-                actual = actual,
++                actual = "%s_%s_files" % (name, tfm),
+                 visibility = ["//visibility:public"],
+             )
+             tfm_target_mapping[tfm] = ":%s_%s_alias" % (name, tfm)
+@@ -642,6 +637,14 @@
+                 next_tfm = get_highest_compatible_target_framework(tfm, [t for t in tfm_rids.keys() if t != tfm])
+                 if next_tfm:
+                     map["//conditions:default"] = ":%s_%s_alias" % (name, next_tfm)
++                else:
++                    empty = "%s_%s_empty" % (name, tfm)
++                    native.filegroup(
++                        name = empty,
++                        srcs = [],
++                        visibility = ["//visibility:public"],
++                    )
++                    map["//conditions:default"] = ":%s" % empty
+             native.alias(
+                 name = "%s_%s_alias" % (name, tfm),
+                 actual = select(map),
diff --git a/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/patches/revert_additional_files_in_nuget_archive.patch b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/patches/revert_additional_files_in_nuget_archive.patch
new file mode 100644
index 000000000000..f1c629694ecb
--- /dev/null
+++ b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/patches/revert_additional_files_in_nuget_archive.patch
@@ -0,0 +1,11 @@
+--- a/dotnet/private/rules/nuget/nuget_archive.bzl	2025-09-04 16:14:49.402400198 +0200
++++ b/dotnet/private/rules/nuget/nuget_archive.bzl	2025-09-04 16:12:16.577010334 +0200
+@@ -123,7 +123,7 @@
+         return
+ 
+     # If the folder is empty we do nothing
+-    if file.endswith(tfm) or file.endswith(tfm + "/"):
++    if file.find("/", tfm_end + 1) != -1:
+         return
+ 
+     group = groups[group_name]
diff --git a/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/source.json b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/source.json
new file mode 100644
index 000000000000..ababa03de6f5
--- /dev/null
+++ b/misc/bazel/registry/modules/rules_dotnet/0.21.5-codeql.2/source.json
@@ -0,0 +1,10 @@
+{
+    "integrity": "sha256-fgvSYSFAtQh+MuDzTji3iWR642WwefGCSzCLLUtZyFE=",
+    "strip_prefix": "rules_dotnet-0.21.5",
+    "url": "https://github.com/bazel-contrib/rules_dotnet/releases/download/v0.21.5/rules_dotnet-v0.21.5.tar.gz",
+    "patches": {
+        "gate_rid_specific_tfm_groups.patch": "sha256-rEDTV56GnexS1ijgYhxcrWRM0TIMuoS9IESqGUEyR0Q=",
+        "revert_additional_files_in_nuget_archive.patch": "sha256-FzMKXeHVhIBXQRCNFB0EANDszgJc/BBaPgWCzkbW9Ck="
+    },
+    "patch_strip": 1
+}
diff --git a/misc/bazel/registry/modules/rules_dotnet/metadata.json b/misc/bazel/registry/modules/rules_dotnet/metadata.json
index ea34a05cfb68..b2907213a00c 100644
--- a/misc/bazel/registry/modules/rules_dotnet/metadata.json
+++ b/misc/bazel/registry/modules/rules_dotnet/metadata.json
@@ -13,7 +13,8 @@
         "github:bazel-contrib/rules_dotnet"
     ],
     "versions": [
-        "0.21.5-codeql.1"
+        "0.21.5-codeql.1",
+        "0.21.5-codeql.2"
     ],
     "yanked_versions": {}
 }