diff --git a/CHANGELOG.md b/CHANGELOG.md
index f703269884..2e29017535 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,8 @@ A brief description of the categories of changes:
 
 ### Fixed
 * (gazelle): Fix incorrect use of `t.Fatal`/`t.Fatalf` in tests.
+* (toolchain) Omit third-party python packages from coverage reports from
+  stage2 bootstrap template.
 
 ### Added
 * Nothing yet
diff --git a/python/private/stage2_bootstrap_template.py b/python/private/stage2_bootstrap_template.py
index 29f59d2195..f66c28bd51 100644
--- a/python/private/stage2_bootstrap_template.py
+++ b/python/private/stage2_bootstrap_template.py
@@ -364,6 +364,14 @@ def _maybe_collect_coverage(enable):
                 # Pipes can't be read back later, which can cause coverage to
                 # throw an error when trying to get its source code.
                 "/dev/fd/*",
+                # The mechanism for finding third-party packages in coverage-py
+                # only works for installed packages, not for runfiles. e.g:
+                #'$HOME/.local/lib/python3.10/site-packages',
+                # '/usr/lib/python',
+                # '/usr/lib/python3.10/site-packages',
+                # '/usr/local/lib/python3.10/dist-packages'
+                # see https://github.com/nedbat/coveragepy/blob/bfb0c708fdd8182b2a9f0fc403596693ef65e475/coverage/inorout.py#L153-L164
+                "*/external/*",
             ],
         )
         cov.start()