diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaInfoBuildHelper.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaInfoBuildHelper.java
index 2a9d98e3b706d0..b698c005d684c1 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaInfoBuildHelper.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaInfoBuildHelper.java
@@ -404,11 +404,17 @@ private static List<String> tokenize(List<String> input) throws EvalException {
   public Artifact buildIjar(
       StarlarkActionFactory actions,
       Artifact inputJar,
+      @Nullable Artifact outputJar,
       @Nullable Label targetLabel,
       JavaToolchainProvider javaToolchain)
       throws EvalException {
-    String ijarBasename = FileSystemUtils.removeExtension(inputJar.getFilename()) + "-ijar.jar";
-    Artifact interfaceJar = actions.declareFile(ijarBasename, inputJar);
+    Artifact interfaceJar;
+    if (outputJar != null) {
+      interfaceJar = outputJar;
+    } else {
+      String ijarBasename = FileSystemUtils.removeExtension(inputJar.getFilename()) + "-ijar.jar";
+      interfaceJar = actions.declareFile(ijarBasename, inputJar);
+    }
     FilesToRunProvider ijarTarget = javaToolchain.getIjar();
     CustomCommandLine.Builder commandLine =
         CustomCommandLine.builder().addExecPath(inputJar).addExecPath(interfaceJar);
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaStarlarkCommon.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaStarlarkCommon.java
index c4d23c7fb5eefe..12c57b16708b74 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaStarlarkCommon.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaStarlarkCommon.java
@@ -187,12 +187,21 @@ public JavaInfo createJavaCompileAction(
   public Artifact runIjar(
       StarlarkActionFactory actions,
       Artifact jar,
+      Object output,
       Object targetLabel,
-      JavaToolchainProvider javaToolchain)
+      JavaToolchainProvider javaToolchain,
+      StarlarkThread thread)
       throws EvalException {
+    if (output != Starlark.NONE) {
+      checkPrivateAccess(thread);
+    }
     return JavaInfoBuildHelper.getInstance()
         .buildIjar(
-            actions, jar, targetLabel != Starlark.NONE ? (Label) targetLabel : null, javaToolchain);
+            actions,
+            jar,
+            output != Starlark.NONE ? (Artifact) output : null,
+            targetLabel != Starlark.NONE ? (Label) targetLabel : null,
+            javaToolchain);
   }
 
   @Override
diff --git a/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/java/JavaCommonApi.java b/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/java/JavaCommonApi.java
index da5a30006d2a74..617db91717c0c7 100644
--- a/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/java/JavaCommonApi.java
+++ b/src/main/java/com/google/devtools/build/lib/starlarkbuildapi/java/JavaCommonApi.java
@@ -320,6 +320,12 @@ JavaInfoT createJavaCompileAction(
       parameters = {
         @Param(name = "actions", named = true, doc = "ctx.actions"),
         @Param(name = "jar", positional = false, named = true, doc = "The jar to run ijar on."),
+        @Param(
+            name = "output",
+            positional = false,
+            named = true,
+            documented = false,
+            defaultValue = "None"),
         @Param(
             name = "target_label",
             positional = false,
@@ -338,9 +344,15 @@ JavaInfoT createJavaCompileAction(
             positional = false,
             named = true,
             doc = "A JavaToolchainInfo to used to find the ijar tool."),
-      })
+      },
+      useStarlarkThread = true)
   FileApi runIjar(
-      StarlarkActionFactoryT actions, FileT jar, Object targetLabel, JavaToolchainT javaToolchain)
+      StarlarkActionFactoryT actions,
+      FileT jar,
+      Object output,
+      Object targetLabel,
+      JavaToolchainT javaToolchain,
+      StarlarkThread thread)
       throws EvalException;
 
   @StarlarkMethod(
diff --git a/src/main/starlark/builtins_bzl/common/java/java_import.bzl b/src/main/starlark/builtins_bzl/common/java/java_import.bzl
index 344fa2cabc5763..1658679a772fdb 100644
--- a/src/main/starlark/builtins_bzl/common/java/java_import.bzl
+++ b/src/main/starlark/builtins_bzl/common/java/java_import.bzl
@@ -20,7 +20,6 @@ load(":common/java/java_common.bzl", "construct_defaultinfo")
 load(":common/java/java_semantics.bzl", "semantics")
 load(":common/java/proguard_validation.bzl", "VALIDATE_PROGUARD_SPECS_IMPLICIT_ATTRS", "validate_proguard_specs")
 load(":common/rule_util.bzl", "merge_attrs")
-load(":common/java/java_util.bzl", "create_single_jar")
 load(":common/java/import_deps_check.bzl", "import_deps_check")
 
 JavaInfo = _builtins.toplevel.JavaInfo
@@ -52,10 +51,11 @@ def _process_with_ijars_if_needed(jars, ctx):
             interface_jar_directory = "_ijar/" + ctx.label.name + "/" + ijar_basename
 
             interface_jar = ctx.actions.declare_file(interface_jar_directory)
-            create_single_jar(
-                ctx,
-                interface_jar,
-                depset([jar]),
+            java_common.run_ijar(
+                ctx.actions,
+                jar = jar,
+                output = interface_jar,
+                java_toolchain = semantics.find_java_toolchain(ctx),
             )
         file_dict[jar] = interface_jar
 
diff --git a/src/test/java/com/google/devtools/build/lib/rules/java/JavaStarlarkApiTest.java b/src/test/java/com/google/devtools/build/lib/rules/java/JavaStarlarkApiTest.java
index 9c3b76d22c8848..208bdfdbff1fd6 100644
--- a/src/test/java/com/google/devtools/build/lib/rules/java/JavaStarlarkApiTest.java
+++ b/src/test/java/com/google/devtools/build/lib/rules/java/JavaStarlarkApiTest.java
@@ -3429,6 +3429,38 @@ public void disallowJavaImportEmptyJars_fails() throws Exception {
     assertContainsEvent("Rule in 'foo' cannot use private API");
   }
 
+  @Test
+  public void testRunIjarIsPrivateApi() throws Exception {
+    JavaToolchainTestUtil.writeBuildFileForJavaToolchain(scratch);
+    scratch.file(
+        "foo/custom_rule.bzl",
+        "def _impl(ctx):",
+        "  java_toolchain = ctx.attr._java_toolchain[java_common.JavaToolchainInfo]",
+        "  java_common.run_ijar(",
+        "    ctx.actions,",
+        "    jar = ctx.actions.declare_file('input.jar'),",
+        "    output = ctx.actions.declare_file('output.jar'),",
+        "    java_toolchain = java_toolchain,",
+        "  )",
+        "  return []",
+        "java_custom_library = rule(",
+        "  implementation = _impl,",
+        "  attrs = {",
+        "    '_java_toolchain': attr.label(default = Label('//java/com/google/test:toolchain')),",
+        "  },",
+        "  fragments = ['java']",
+        ")");
+    scratch.file(
+        "foo/BUILD",
+        "load(':custom_rule.bzl', 'java_custom_library')",
+        "java_custom_library(name = 'custom')");
+    reporter.removeHandler(failFastHandler);
+
+    getConfiguredTarget("//foo:custom");
+
+    assertContainsEvent("Rule in 'foo' cannot use private API");
+  }
+
   @Test
   public void testGetBuildInfoArtifacts() throws Exception {
     scratch.file(