diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/genrule/BazelGenRuleRule.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/genrule/BazelGenRuleRule.java
index 2170f8602e9160..93ac4085df4581 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/genrule/BazelGenRuleRule.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/genrule/BazelGenRuleRule.java
@@ -70,6 +70,13 @@ public RuleDefinition.Metadata getMetadata() {
   to the existing <code>cc_*</code> rules, because all the heavy lifting has already been done
   for you.
 </p>
+<p>
+  Note that genrule requires a shell to interpret the command argument.
+  It is also easy to reference arbitrary programs available on the PATH, however this makes the
+  command non-hermetic and may not be reproducible.
+  If you only need to run a single tool, consider using
+  <a href="https://github.com/bazelbuild/bazel-skylib/blob/main/docs/run_binary_doc.md">run_binary</a>
+  instead.
 <p>
   Do not use a genrule for running tests. There are special dispensations for tests and test
   results, including caching policies and environment variables. Tests generally need to be run