diff --git a/BUILD.bazel b/BUILD.bazel
index bdd9830f6270..1f9ba6d7a89f 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -400,6 +400,15 @@ ddk_headers(
     visibility = ["//visibility:public"],
 )
 
+ddk_headers(
+    name = "all_headers_arm",
+    hdrs = [":all_headers_allowlist_arm"] + select({
+        "//build/kernel/kleaf:allow_ddk_unsafe_headers_set": [":all_headers_unsafe"],
+        "//conditions:default": [],
+    }),
+    visibility = ["//visibility:public"],
+)
+
 ddk_headers(
     name = "all_headers_x86_64",
     hdrs = [":all_headers_allowlist_x86_64"] + select({
@@ -432,6 +441,24 @@ ddk_headers(
     visibility = ["//visibility:private"],
 )
 
+ddk_headers(
+    name = "all_headers_allowlist_arm",
+    hdrs = [
+        ":all_headers_allowlist_arm_globs",
+        ":all_headers_allowlist_common_globs",
+    ],
+    # The list of include directories where source files can #include headers
+    # from. In other words, these are the `-I` option to the C compiler.
+    # These are prepended to LINUXINCLUDE.
+    linux_includes = [
+        "arch/arm64/include",
+        "arch/arm64/include/uapi",
+        "include",
+        "include/uapi",
+    ],
+    visibility = ["//visibility:private"],
+)
+
 ddk_headers(
     name = "all_headers_allowlist_x86_64",
     hdrs = [
@@ -456,6 +483,13 @@ ddk_headers(
 # These are separate filegroup targets so the all_headers_allowlist_* are
 # more friendly to batch BUILD file update tools like buildozer.
 
+# globs() for arm only
+filegroup(
+    name = "all_headers_allowlist_arm_globs",
+    srcs = glob(["arch/arm/include/**/*.h"]),
+    visibility = ["//visibility:private"],
+)
+
 # globs() for arm64 only
 filegroup(
     name = "all_headers_allowlist_aarch64_globs",