diff --git a/projects/github.com/cockroachdb/cockroach/package.yml b/projects/github.com/cockroachdb/cockroach/package.yml
new file mode 100644
index 0000000000..6d270f88cd
--- /dev/null
+++ b/projects/github.com/cockroachdb/cockroach/package.yml
@@ -0,0 +1,82 @@
+distributable:
+  url: https://github.com/cockroachdb/cockroach/archive/refs/tags/v{{version}}.tar.gz
+  strip-components: 1
+
+display-name: CockroachDB
+
+versions:
+  # cockroach publishes git tags but no GitHub releases, so query tags directly
+  github: cockroachdb/cockroach/tags
+  ignore:
+    - /-alpha/
+    - /-beta/
+    - /-rc/
+
+platforms:
+  - linux/x86-64
+  - linux/aarch64
+  - darwin/x86-64
+  - darwin/aarch64
+
+provides:
+  - bin/cockroach
+
+build:
+  dependencies:
+    go.dev: ^1.25
+    cmake.org: ^3
+    gnu.org/make: '*'
+    gnu.org/autoconf: '*'
+    gnu.org/bison: '*'
+    gnu.org/patch: '*'
+    freedesktop.org/pkg-config: '*'
+    github.com/bazelbuild/bazelisk: '*'
+    git-scm.org: '*'
+    linux:
+      gnu.org/gcc: '*'
+      invisible-island.net/ncurses: '*'
+  env:
+    # cockroach embeds version info from git; without a .git dir the build
+    # falls back to "unknown". Inject a stable version through the linker.
+    STABLE_BUILD_TAG: v{{version}}
+    USE_BAZEL_VERSION: '7.6.0'
+  script:
+    # cockroach's .bazelrc enables --incompatible_strict_action_env, which
+    # wipes HOME and PATH from each spawned compiler action. pkgx's gcc
+    # wrapper relies on $HOME/toolchain/<tool> and on tools (ar, ranlib...)
+    # being on PATH, so we forward both into action envs explicitly.
+    - PKGX_PATH="$PATH"
+    - PKGX_HOME="$HOME"
+    # the github source tarball has no .git directory; cockroach's bazel
+    # rules rely on workspace_status.sh probing git, so stub it
+    - |
+      cat > build/bazelutil/stamp.sh <<'EOSTAMP'
+      #!/usr/bin/env bash
+      echo STABLE_BUILD_CHANNEL release
+      echo STABLE_BUILD_TAG v__VERSION__
+      echo STABLE_BUILD_TYPE release
+      echo STABLE_BUILD_TARGET_TRIPLE __TRIPLE__
+      echo STABLE_CRASH_REPORT_ENV v__VERSION__
+      echo STABLE_TELEMETRY_DISABLED true
+      EOSTAMP
+    - sed -i.bak "s/__VERSION__/{{version}}/g;s|__TRIPLE__|$(go env GOOS)-$(go env GOARCH)|g" build/bazelutil/stamp.sh
+    - rm -f build/bazelutil/stamp.sh.bak
+    - chmod +x build/bazelutil/stamp.sh
+    # cockroach-short is the pure-binary target (no embedded JS web UI),
+    # which keeps the build tractable without docker / nodejs in CI.
+    # `--spawn_strategy=local` disables bazel's sandbox so pkgx's gcc
+    # wrapper can reach $HOME/toolchain/gcc (the sandbox masks $HOME).
+    - bazel build //pkg/cmd/cockroach-short:cockroach-short
+        --config=ci
+        --jobs={{ hw.concurrency }}
+        --spawn_strategy=local
+        --action_env=HOME=$PKGX_HOME
+        --action_env=PATH=$PKGX_PATH
+        --workspace_status_command=$(pwd)/build/bazelutil/stamp.sh
+    - install -D -m755 bazel-bin/pkg/cmd/cockroach-short/cockroach-short_/cockroach-short
+        "{{prefix}}/bin/cockroach"
+    # do not leave the bazel cache behind
+    - bazel clean --expunge || true
+
+test:
+  - cockroach version | grep -i "{{version}}"