diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 0dba4ff..755a749 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -30,9 +30,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        config:
-          - asan_ubsan_lsan
-          - tsan
+        include:
+          - config: asan_ubsan_lsan
+            description: "ASan + UBSan + LSan"
+          - config: asan
+            description: "AddressSanitizer"
+          - config: ubsan
+            description: "UndefinedBehaviorSanitizer"
+          - config: lsan
+            description: "LeakSanitizer"
+          - config: tsan
+            description: "ThreadSanitizer"
     
     steps:
       - name: Checkout
diff --git a/README.md b/README.md
index 707ea02..81a9b6f 100644
--- a/README.md
+++ b/README.md
@@ -16,11 +16,12 @@ Planned: clang-tidy, clang-format, code coverage policies.
 
 | Config | Sanitizers | Notes |
 |--------|-----------|-------|
-| `--config=asan_ubsan_lsan` | ASan + UBSan + LSan | **Recommended** — catches memory errors, UB, and leaks |
-| `--config=asan` | AddressSanitizer | Alias for `asan_ubsan_lsan` |
-| `--config=ubsan` | UndefinedBehaviorSanitizer | Alias for `asan_ubsan_lsan` |
-| `--config=lsan` | LeakSanitizer | Alias for `asan_ubsan_lsan` |
-| `--config=tsan` | ThreadSanitizer | Cannot be combined with ASan |
+| `--config=asan` | AddressSanitizer | Memory errors, buffer overflows |
+| `--config=ubsan` | UndefinedBehaviorSanitizer | Integer overflow, null deref |
+| `--config=lsan` | LeakSanitizer | Memory leaks |
+| `--config=tsan` | ThreadSanitizer | Data races, deadlocks — cannot combine with ASan/LSan |
+| `--config=asan_ubsan_lsan` | ASan + UBSan + LSan | **Recommended default for CI** |
+| `--config=tsan_ubsan` | TSan + UBSan | Threading + undefined behavior |
 
 ## Usage
 
@@ -105,6 +106,18 @@ bazel test --config=asan_ubsan_lsan //...
 bazel test --config=tsan //...
 ```
 
+## Migration from v0.x
+
+The `--@score_cpp_policies//sanitizers/flags:sanitizer=<value>` string flag has been removed.
+Replace any direct flag usage with the equivalent `--config=` alias:
+
+| Old | New |
+|-----|-----|
+| `--@score_cpp_policies//sanitizers/flags:sanitizer=asan_ubsan_lsan` | `--config=asan_ubsan_lsan` |
+| `--@score_cpp_policies//sanitizers/flags:sanitizer=tsan` | `--config=tsan` |
+
+`--config=asan`, `--config=ubsan`, and `--config=lsan` now activate exactly their named sanitizer rather than the combined `asan_ubsan_lsan` mode.
+
 ## Contributing
 
 See [CONTRIBUTION.md](CONTRIBUTION.md) for guidelines. All commits must follow [Eclipse Foundation commit rules](https://www.eclipse.org/projects/handbook/#resources-commit). Contributors must sign the ECA and DCO.
diff --git a/sanitizers/BUILD.bazel b/sanitizers/BUILD.bazel
index 0d086b2..074869f 100644
--- a/sanitizers/BUILD.bazel
+++ b/sanitizers/BUILD.bazel
@@ -18,52 +18,59 @@ exports_files(
     visibility = ["//visibility:public"],
 )
 
-filegroup(
-    name = "env_template",
-    srcs = select({
-        "//sanitizers/flags:tsan": ["templates/tsan.env.template"],
-        "//sanitizers/flags:asan_ubsan_lsan": ["templates/asan_ubsan_lsan.env.template"],
-    }),
-    target_compatible_with = ["//sanitizers/constraints:any_sanitizer"],
-)
+_SANITIZERS = {
+    "asan": "templates/asan.env.template",
+    "ubsan": "templates/ubsan.env.template",
+    "lsan": "templates/lsan.env.template",
+    "tsan": "templates/tsan.env.template",
+}
+
+_ROOTS = {
+    "absolute": "/",
+    "relative": "./",
+}
 
 [
     expand_template(
-        name = name + "_env",
-        out = name + "_sanitizer.env",
-        substitutions = {"%ROOT%": root},
+        name = sanitizer + "_" + root_name + "_env",
+        out = sanitizer + "_" + root_name + "_sanitizer.env",
+        substitutions = {"%ROOT%": root_path},
         target_compatible_with = ["//sanitizers/constraints:any_sanitizer"],
-        template = ":env_template",
+        template = template,
         visibility = ["//visibility:public"],
     )
-    for name, root in [
-        ("absolute", "/"),
-        ("relative", "./"),
-    ]
+    for sanitizer, template in _SANITIZERS.items()
+    for root_name, root_path in _ROOTS.items()
 ]
 
-filegroup(
-    name = "suppressions",
-    srcs = select({
-        "//sanitizers/flags:tsan": ["suppressions/tsan.supp"],
-        "//sanitizers/flags:asan_ubsan_lsan": [
+sh_binary(
+    name = "wrapper",
+    srcs = ["wrapper.sh"],
+    data = select({
+        "//sanitizers/flags:asan_on": [
             "suppressions/asan.supp",
-            "suppressions/lsan.supp",
+            ":asan_relative_env",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "//sanitizers/flags:ubsan_on": [
             "suppressions/ubsan.supp",
+            ":ubsan_relative_env",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "//sanitizers/flags:lsan_on": [
+            "suppressions/lsan.supp",
+            ":lsan_relative_env",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "//sanitizers/flags:tsan_on": [
+            "suppressions/tsan.supp",
+            ":tsan_relative_env",
         ],
         "//conditions:default": [],
     }),
     target_compatible_with = ["//sanitizers/constraints:any_sanitizer"],
     visibility = ["//visibility:public"],
 )
-
-sh_binary(
-    name = "wrapper",
-    srcs = ["wrapper.sh"],
-    data = [
-        ":relative_env",
-        ":suppressions",
-    ],
-    target_compatible_with = ["//sanitizers/constraints:any_sanitizer"],
-    visibility = ["//visibility:public"],
-)
diff --git a/sanitizers/constraints/BUILD.bazel b/sanitizers/constraints/BUILD.bazel
index 0f123ae..bed952e 100644
--- a/sanitizers/constraints/BUILD.bazel
+++ b/sanitizers/constraints/BUILD.bazel
@@ -31,9 +31,27 @@ alias(
 )
 
 alias(
-    name = "no_asan_ubsan_lsan",
+    name = "no_asan",
+    actual = select({
+        "//sanitizers/flags:asan_on": "@platforms//:incompatible",
+        "//conditions:default": ":always_true",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "no_ubsan",
+    actual = select({
+        "//sanitizers/flags:ubsan_on": "@platforms//:incompatible",
+        "//conditions:default": ":always_true",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "no_lsan",
     actual = select({
-        "//sanitizers/flags:asan_ubsan_lsan": "@platforms//:incompatible",
+        "//sanitizers/flags:lsan_on": "@platforms//:incompatible",
         "//conditions:default": ":always_true",
     }),
     visibility = ["//visibility:public"],
@@ -42,8 +60,54 @@ alias(
 alias(
     name = "no_tsan",
     actual = select({
-        "//sanitizers/flags:tsan": "@platforms//:incompatible",
+        "//sanitizers/flags:tsan_on": "@platforms//:incompatible",
         "//conditions:default": ":always_true",
     }),
     visibility = ["//visibility:public"],
 )
+
+alias(
+    name = "no_asan_ubsan_lsan",
+    actual = select({
+        "//sanitizers/flags:any_asan_ubsan_lsan": "@platforms//:incompatible",
+        "//conditions:default": ":always_true",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+# "Only when" constraints — for negative tests that must run only under their specific sanitizer.
+alias(
+    name = "only_asan",
+    actual = select({
+        "//sanitizers/flags:asan_on": ":always_true",
+        "//conditions:default": "@platforms//:incompatible",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "only_ubsan",
+    actual = select({
+        "//sanitizers/flags:ubsan_on": ":always_true",
+        "//conditions:default": "@platforms//:incompatible",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "only_lsan",
+    actual = select({
+        "//sanitizers/flags:lsan_on": ":always_true",
+        "//conditions:default": "@platforms//:incompatible",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "only_tsan",
+    actual = select({
+        "//sanitizers/flags:tsan_on": ":always_true",
+        "//conditions:default": "@platforms//:incompatible",
+    }),
+    visibility = ["//visibility:public"],
+)
diff --git a/sanitizers/features/BUILD.bazel b/sanitizers/features/BUILD.bazel
index c3eed35..1aac263 100644
--- a/sanitizers/features/BUILD.bazel
+++ b/sanitizers/features/BUILD.bazel
@@ -13,9 +13,8 @@
 
 load("@rules_cc//cc/toolchains:args.bzl", "cc_args")
 load("@rules_cc//cc/toolchains:feature.bzl", "cc_feature")
-load("@rules_cc//cc/toolchains:mutually_exclusive_category.bzl", "cc_mutually_exclusive_category")
 
-# Minimal debug info for stack traces (-g1) must be combined with command line option --strip=never
+# Minimal debug info for stack traces (-g1); combine with --strip=never (set in sanitizers.bazelrc).
 cc_args(
     name = "debug_symbols_args",
     actions = [
@@ -27,126 +26,113 @@ cc_args(
 
 cc_feature(
     name = "debug_symbols",
-    feature_name = "debug_symbols",
     args = [":debug_symbols_args"],
+    feature_name = "debug_symbols",
     visibility = ["//visibility:public"],
 )
 
-cc_mutually_exclusive_category(
-    name = "sanitizer",
-    visibility = ["//visibility:public"],
-)
-
-# Compile + link flags for ASan + UBSan + LSan combined
 cc_args(
-    name = "asan_ubsan_lsan_compile_args",
-    actions = [
-        "@rules_cc//cc/toolchains/actions:compile_actions",
-    ],
-    args = ["-fsanitize=undefined,address,leak"],
+    name = "asan_compile_args",
+    actions = ["@rules_cc//cc/toolchains/actions:compile_actions"],
+    args = ["-fsanitize=address"],
     visibility = ["//visibility:public"],
 )
 
 cc_args(
-    name = "asan_ubsan_lsan_link_args",
-    actions = [
-        "@rules_cc//cc/toolchains/actions:link_actions",
-    ],
-    args = [
-        "-fsanitize=undefined,address,leak",
-        "-fsanitize-link-c++-runtime",
-    ],
+    name = "asan_link_args",
+    actions = ["@rules_cc//cc/toolchains/actions:link_actions"],
+    args = ["-fsanitize=address"],
     visibility = ["//visibility:public"],
 )
 
 cc_feature(
-    name = "asan_ubsan_lsan",
-    feature_name = "score_asan_ubsan_lsan",
+    name = "asan",
     args = [
-        ":asan_ubsan_lsan_compile_args",
-        ":asan_ubsan_lsan_link_args",
+        ":asan_compile_args",
+        ":asan_link_args",
     ],
+    feature_name = "score_asan",
     implies = ["debug_symbols"],
-    mutually_exclusive = [":sanitizer"],
     visibility = ["//visibility:public"],
 )
 
-# Compile + link flags for ThreadSanitizer
 cc_args(
-    name = "tsan_compile_args",
-    actions = [
-        "@rules_cc//cc/toolchains/actions:compile_actions",
-    ],
-    args = [
-        "-fsanitize=thread",
-        # Recommended by Clang TSan docs: https://clang.llvm.org/docs/ThreadSanitizer.html
-        "-O1",
-    ],
+    name = "ubsan_compile_args",
+    actions = ["@rules_cc//cc/toolchains/actions:compile_actions"],
+    args = ["-fsanitize=undefined"],
     visibility = ["//visibility:public"],
 )
 
 cc_args(
-    name = "tsan_link_args",
-    actions = [
-        "@rules_cc//cc/toolchains/actions:link_actions",
-    ],
+    name = "ubsan_link_args",
+    actions = ["@rules_cc//cc/toolchains/actions:link_actions"],
     args = [
-        "-fsanitize=thread",
+        "-fsanitize=undefined",
         "-fsanitize-link-c++-runtime",
     ],
     visibility = ["//visibility:public"],
 )
 
 cc_feature(
-    name = "tsan",
-    feature_name = "score_tsan",
+    name = "ubsan",
     args = [
-        ":tsan_compile_args",
-        ":tsan_link_args",
+        ":ubsan_compile_args",
+        ":ubsan_link_args",
     ],
+    feature_name = "score_ubsan",
     implies = ["debug_symbols"],
-    mutually_exclusive = [":sanitizer"],
     visibility = ["//visibility:public"],
 )
 
-# ==============================================================================
-# GCC-compatible features (omit -fsanitize-link-c++-runtime which is Clang-only)
-# ==============================================================================
+cc_args(
+    name = "lsan_compile_args",
+    actions = ["@rules_cc//cc/toolchains/actions:compile_actions"],
+    args = ["-fsanitize=leak"],
+    visibility = ["//visibility:public"],
+)
 
 cc_args(
-    name = "asan_ubsan_lsan_link_args_gcc",
+    name = "lsan_link_args",
     actions = ["@rules_cc//cc/toolchains/actions:link_actions"],
-    args = ["-fsanitize=undefined,address,leak"],
+    args = ["-fsanitize=leak"],
     visibility = ["//visibility:public"],
 )
 
 cc_feature(
-    name = "asan_ubsan_lsan_gcc",
-    feature_name = "score_asan_ubsan_lsan",
+    name = "lsan",
     args = [
-        ":asan_ubsan_lsan_compile_args",
-        ":asan_ubsan_lsan_link_args_gcc",
+        ":lsan_compile_args",
+        ":lsan_link_args",
     ],
+    feature_name = "score_lsan",
     implies = ["debug_symbols"],
-    mutually_exclusive = [":sanitizer"],
     visibility = ["//visibility:public"],
 )
 
 cc_args(
-    name = "tsan_link_args_gcc",
+    name = "tsan_compile_args",
+    actions = ["@rules_cc//cc/toolchains/actions:compile_actions"],
+    args = [
+        "-fsanitize=thread",
+        "-O1",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+cc_args(
+    name = "tsan_link_args",
     actions = ["@rules_cc//cc/toolchains/actions:link_actions"],
     args = ["-fsanitize=thread"],
     visibility = ["//visibility:public"],
 )
 
 cc_feature(
-    name = "tsan_gcc",
-    feature_name = "score_tsan",
+    name = "tsan",
     args = [
         ":tsan_compile_args",
-        ":tsan_link_args_gcc",
+        ":tsan_link_args",
     ],
+    feature_name = "score_tsan",
     implies = ["debug_symbols"],
-    mutually_exclusive = [":sanitizer"],
     visibility = ["//visibility:public"],
 )
diff --git a/sanitizers/flags/BUILD.bazel b/sanitizers/flags/BUILD.bazel
index fef3ce3..224cfb1 100644
--- a/sanitizers/flags/BUILD.bazel
+++ b/sanitizers/flags/BUILD.bazel
@@ -12,42 +12,83 @@
 # *******************************************************************************
 
 load("@bazel_skylib//lib:selects.bzl", "selects")
-load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
-
-string_flag(
-    name = "sanitizer",
-    build_setting_default = "none",
-    values = [
-        "none",
-        "asan_ubsan_lsan",
-        "tsan",
-    ],
+load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
+
+bool_flag(
+    name = "asan",
+    build_setting_default = False,
     visibility = ["//visibility:public"],
 )
 
 config_setting(
-    name = "none",
-    flag_values = {":sanitizer": "none"},
+    name = "asan_on",
+    flag_values = {":asan": "True"},
+    visibility = ["//visibility:public"],
+)
+
+bool_flag(
+    name = "ubsan",
+    build_setting_default = False,
     visibility = ["//visibility:public"],
 )
 
 config_setting(
-    name = "asan_ubsan_lsan",
-    flag_values = {":sanitizer": "asan_ubsan_lsan"},
+    name = "ubsan_on",
+    flag_values = {":ubsan": "True"},
+    visibility = ["//visibility:public"],
+)
+
+bool_flag(
+    name = "lsan",
+    build_setting_default = False,
     visibility = ["//visibility:public"],
 )
 
 config_setting(
+    name = "lsan_on",
+    flag_values = {":lsan": "True"},
+    visibility = ["//visibility:public"],
+)
+
+bool_flag(
     name = "tsan",
-    flag_values = {":sanitizer": "tsan"},
+    build_setting_default = False,
+    visibility = ["//visibility:public"],
+)
+
+config_setting(
+    name = "tsan_on",
+    flag_values = {":tsan": "True"},
     visibility = ["//visibility:public"],
 )
 
 selects.config_setting_group(
     name = "any_sanitizer",
     match_any = [
-        ":asan_ubsan_lsan",
-        ":tsan",
+        ":asan_on",
+        ":ubsan_on",
+        ":lsan_on",
+        ":tsan_on",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+selects.config_setting_group(
+    name = "any_asan_ubsan_lsan",
+    match_any = [
+        ":asan_on",
+        ":ubsan_on",
+        ":lsan_on",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+selects.config_setting_group(
+    name = "asan_ubsan_lsan",
+    match_all = [
+        ":asan_on",
+        ":ubsan_on",
+        ":lsan_on",
     ],
     visibility = ["//visibility:public"],
 )
diff --git a/sanitizers/sanitizers.bazelrc b/sanitizers/sanitizers.bazelrc
index 396972a..db2f50b 100644
--- a/sanitizers/sanitizers.bazelrc
+++ b/sanitizers/sanitizers.bazelrc
@@ -12,42 +12,49 @@
 # *******************************************************************************
 
 # ==============================================================================
-# Centralized Sanitizer Configurations for S-CORE C++ Modules
-# ==============================================================================
-#
-# Available configurations:
-#   --config=asan_ubsan_lsan  : AddressSanitizer + UndefinedBehaviorSanitizer + LeakSanitizer (Combined)
-#   --config=asan             : AddressSanitizer only
-#   --config=lsan             : LeakSanitizer only
-#   --config=tsan             : ThreadSanitizer (cannot be combined with ASan)
-#   --config=ubsan            : UndefinedBehaviorSanitizer only
+# Debug symbols — used by all sanitizer configs below
 # ==============================================================================
 
-# -g1: Minimal debug info (function names + line numbers) for sanitizer stack traces
-# GCC and Clang compatible. Note: Clang's -gline-tables-only provides column info but is not GCC-compatible.
 test:with_debug_symbols --features=debug_symbols
-# Disable stripping so debug symbols are preserved at the final link stage
 build:with_debug_symbols --strip=never
 
-# AddressSanitizer + UndefinedBehaviorSanitizer + LeakSanitizer (Combined)
-build:asan_ubsan_lsan --features=score_asan_ubsan_lsan
-build:asan_ubsan_lsan --platform_suffix=asan_ubsan_lsan
-build:asan_ubsan_lsan --config=with_debug_symbols
-build:asan_ubsan_lsan --@score_cpp_policies//sanitizers/flags:sanitizer=asan_ubsan_lsan
-test:asan_ubsan_lsan --run_under=@score_cpp_policies//sanitizers:wrapper
+# ==============================================================================
+# Per-sanitizer configs (primary API — each activates exactly one sanitizer)
+# ==============================================================================
 
-# AddressSanitizer only
-build:asan  --config=asan_ubsan_lsan
+build:asan --features=score_asan
+build:asan --@score_cpp_policies//sanitizers/flags:asan=True
+build:asan --platform_suffix=asan
+build:asan --config=with_debug_symbols
+test:asan  --run_under=@score_cpp_policies//sanitizers:wrapper
 
-# UndefinedBehaviorSanitizer only
-build:ubsan --config=asan_ubsan_lsan
+build:ubsan --features=score_ubsan
+build:ubsan --@score_cpp_policies//sanitizers/flags:ubsan=True
+build:ubsan --platform_suffix=ubsan
+build:ubsan --config=with_debug_symbols
+test:ubsan  --run_under=@score_cpp_policies//sanitizers:wrapper
 
-# LeakSanitizer only
-build:lsan  --config=asan_ubsan_lsan
+build:lsan --features=score_lsan
+build:lsan --@score_cpp_policies//sanitizers/flags:lsan=True
+build:lsan --platform_suffix=lsan
+build:lsan --config=with_debug_symbols
+test:lsan  --run_under=@score_cpp_policies//sanitizers:wrapper
 
-# ThreadSanitizer (cannot be combined with ASan/LSan)
 build:tsan --features=score_tsan
+build:tsan --@score_cpp_policies//sanitizers/flags:tsan=True
 build:tsan --platform_suffix=tsan
 build:tsan --config=with_debug_symbols
-build:tsan --@score_cpp_policies//sanitizers/flags:sanitizer=tsan
-test:tsan --run_under=@score_cpp_policies//sanitizers:wrapper
+test:tsan  --run_under=@score_cpp_policies//sanitizers:wrapper
+
+# ==============================================================================
+# Composite configs — convenience aliases for common combinations
+# ==============================================================================
+
+build:asan_ubsan_lsan --config=asan
+build:asan_ubsan_lsan --config=ubsan
+build:asan_ubsan_lsan --config=lsan
+build:asan_ubsan_lsan --platform_suffix=asan_ubsan_lsan
+
+build:tsan_ubsan --config=tsan
+build:tsan_ubsan --config=ubsan
+build:tsan_ubsan --platform_suffix=tsan_ubsan
diff --git a/sanitizers/templates/asan.env.template b/sanitizers/templates/asan.env.template
new file mode 100644
index 0000000..b22a656
--- /dev/null
+++ b/sanitizers/templates/asan.env.template
@@ -0,0 +1 @@
+ASAN_OPTIONS=allocator_may_return_null=1 allow_addr2line=1 check_initialization_order=1 detect_stack_use_after_return=1 exitcode=55 halt_on_error=1 print_stats=1 strict_string_checks=1 verbosity=1 suppressions=%ROOT%sanitizers/suppressions/asan.supp
diff --git a/sanitizers/templates/asan_ubsan_lsan.env.template b/sanitizers/templates/asan_ubsan_lsan.env.template
deleted file mode 100644
index 11960e8..0000000
--- a/sanitizers/templates/asan_ubsan_lsan.env.template
+++ /dev/null
@@ -1,3 +0,0 @@
-ASAN_OPTIONS=allocator_may_return_null=1 allow_addr2line=1 check_initialization_order=1 detect_leaks=1 detect_stack_use_after_return=1 exitcode=55 halt_on_error=1 print_stats=1 strict_string_checks=1 verbosity=1 suppressions=%ROOT%sanitizers/suppressions/asan.supp
-UBSAN_OPTIONS=allow_addr2line=1 exitcode=55 halt_on_error=1 print_stacktrace=1 verbosity=1 suppressions=%ROOT%sanitizers/suppressions/ubsan.supp
-LSAN_OPTIONS=exitcode=55 suppressions=%ROOT%sanitizers/suppressions/lsan.supp
diff --git a/sanitizers/templates/lsan.env.template b/sanitizers/templates/lsan.env.template
new file mode 100644
index 0000000..2c5a481
--- /dev/null
+++ b/sanitizers/templates/lsan.env.template
@@ -0,0 +1 @@
+LSAN_OPTIONS=exitcode=55 suppressions=%ROOT%sanitizers/suppressions/lsan.supp
diff --git a/sanitizers/templates/ubsan.env.template b/sanitizers/templates/ubsan.env.template
new file mode 100644
index 0000000..93204c3
--- /dev/null
+++ b/sanitizers/templates/ubsan.env.template
@@ -0,0 +1 @@
+UBSAN_OPTIONS=allow_addr2line=1 exitcode=55 halt_on_error=1 print_stacktrace=1 verbosity=1 suppressions=%ROOT%sanitizers/suppressions/ubsan.supp
diff --git a/sanitizers/wrapper.sh b/sanitizers/wrapper.sh
index 19d8fa1..1e56154 100755
--- a/sanitizers/wrapper.sh
+++ b/sanitizers/wrapper.sh
@@ -15,8 +15,13 @@
 
 WRAPPER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-IFS='
-'
-# shellcheck disable=SC2046
-export $(sed "s|\./sanitizers/|$WRAPPER_DIR/|g" "$WRAPPER_DIR/relative_sanitizer.env" | grep -v '^#' | grep -v '^$')
+for env_file in "$WRAPPER_DIR"/*_relative_sanitizer.env; do
+    [ -f "$env_file" ] || continue
+    while IFS= read -r line || [ -n "$line" ]; do
+        [[ "$line" =~ ^# ]] && continue
+        [[ -z "$line" ]] && continue
+        export "${line?}"
+    done < <(sed "s|\./sanitizers/|$WRAPPER_DIR/|g" "$env_file")
+done
+
 exec "$@"
diff --git a/tests/.bazelrc b/tests/.bazelrc
index d2b7f84..939f137 100644
--- a/tests/.bazelrc
+++ b/tests/.bazelrc
@@ -18,5 +18,7 @@ common --registry=https://raw.githubusercontent.com/eclipse-score/bazel_registry
 common --registry=https://bcr.bazel.build
 
 # Use LLVM toolchain for sanitizer configs (same as consuming modules)
-build:asan_ubsan_lsan --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
-build:tsan --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
+build:asan  --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
+build:ubsan --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
+build:lsan  --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
+build:tsan  --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
diff --git a/tests/BUILD.bazel b/tests/BUILD.bazel
index 7a4a276..40f27e9 100644
--- a/tests/BUILD.bazel
+++ b/tests/BUILD.bazel
@@ -20,7 +20,7 @@ load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_test")
 cc_test(
     name = "sample_test",
     srcs = ["sample_test.cpp"],
-    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:no_tsan"],  # TSAN has known issues with googletest
+    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:no_tsan"],  # GoogleTest has known TSan false positives
     deps = [
         "@googletest//:gtest",
         "@googletest//:gtest_main",
@@ -33,26 +33,26 @@ cc_test(
 
 cc_binary(
     name = "asan_fail_test",
-    srcs = ["negative/asan_fail.cpp"],
     testonly = True,
+    srcs = ["negative/asan_fail.cpp"],
 )
 
 cc_binary(
     name = "lsan_fail_test",
-    srcs = ["negative/lsan_fail.cpp"],
     testonly = True,
+    srcs = ["negative/lsan_fail.cpp"],
 )
 
 cc_binary(
     name = "tsan_fail_test",
-    srcs = ["negative/tsan_fail.cpp"],
     testonly = True,
+    srcs = ["negative/tsan_fail.cpp"],
 )
 
 cc_binary(
     name = "ubsan_fail_test",
-    srcs = ["negative/ubsan_fail.cpp"],
     testonly = True,
+    srcs = ["negative/ubsan_fail.cpp"],
 )
 
 # ==============================================================================
@@ -67,7 +67,7 @@ sh_test(
         "55",
     ],
     data = [":asan_fail_test"],
-    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:no_tsan"],
+    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:only_asan"],
 )
 
 sh_test(
@@ -78,7 +78,7 @@ sh_test(
         "55",
     ],
     data = [":lsan_fail_test"],
-    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:no_tsan"],
+    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:only_lsan"],
 )
 
 sh_test(
@@ -89,7 +89,7 @@ sh_test(
         "55",
     ],
     data = [":tsan_fail_test"],
-    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:no_asan_ubsan_lsan"],
+    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:only_tsan"],
 )
 
 sh_test(
@@ -100,6 +100,5 @@ sh_test(
         "55",
     ],
     data = [":ubsan_fail_test"],
-    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:no_tsan"],
+    target_compatible_with = ["@score_cpp_policies//sanitizers/constraints:only_ubsan"],
 )
-
diff --git a/tests/MODULE.bazel b/tests/MODULE.bazel
index 62d0e1b..550fa2c 100644
--- a/tests/MODULE.bazel
+++ b/tests/MODULE.bazel
@@ -16,9 +16,8 @@ module(
 )
 
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
-bazel_dep(name = "rules_cc", version = "0.1.5")
+bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "toolchains_llvm", version = "1.7.0")
-
 bazel_dep(name = "score_cpp_policies")
 local_path_override(
     module_name = "score_cpp_policies",
@@ -27,11 +26,13 @@ local_path_override(
 
 llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
 llvm.toolchain(
-    llvm_version = "19.1.7",
     extra_known_features = [
         "@score_cpp_policies//sanitizers/features:debug_symbols",
-        "@score_cpp_policies//sanitizers/features:asan_ubsan_lsan",
+        "@score_cpp_policies//sanitizers/features:asan",
+        "@score_cpp_policies//sanitizers/features:ubsan",
+        "@score_cpp_policies//sanitizers/features:lsan",
         "@score_cpp_policies//sanitizers/features:tsan",
     ],
+    llvm_version = "19.1.7",
 )
 use_repo(llvm, "llvm_toolchain")