diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c868fb1..8ee8d99 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,22 @@
 name: Build
-on: [ pull_request ]
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - labeled
+      - unlabeled
+      - opened
+      - edited
+      - reopened
+      - synchronize
+      - ready_for_review
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
@@ -10,7 +27,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Cache Bazel
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cache/bazel
@@ -19,8 +36,4 @@ jobs:
           ${{ runner.os }}-bazel-
 
     - name: Build everything
-      run: bazel build //...
-
-    # - name: Test everything
-    #   run: bazel test //...
-
+      run: bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc build //...
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
new file mode 100644
index 0000000..40f1b4c
--- /dev/null
+++ b/.github/workflows/ci.bazelrc
@@ -0,0 +1,13 @@
+# This file contains Bazel settings to apply on CI only.
+# It is referenced with a --bazelrc option in the call to bazel in ci.yaml
+
+# Debug where options came from
+build --announce_rc
+# This directory is configured in GitHub actions to be persisted between runs.
+# We do not enable the repository cache to cache downloaded external artifacts
+# as these are generally faster to download again than to fetch them from the
+# GitHub actions cache.
+build --disk_cache=~/.cache/bazel
+# Don't rely on test logs being easily accessible from the test runner,
+# though it makes the log noisier.
+test --test_output=errors
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2976ad7..76febf2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,5 @@
 name: Release
+
 on:
   push:
     tags:
@@ -13,7 +14,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Cache Bazel
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cache/bazel
@@ -22,17 +23,17 @@ jobs:
           ${{ runner.os }}-bazel-
 
     - name: Login to GitHub Container Registry
-      uses: docker/login-action@v2
+      uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Push service-one image to ghcr.io
-      run: bazel run --stamp --embed_label=${{ github.ref_name }} //service-one:push_image
+      run: bazel run --stamp --embed_label=${{ github.ref_name }} --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc //service-one:push_image
 
     - name: Push authz image to ghcr.io
-      run: bazel run --stamp --embed_label=${{ github.ref_name }} //authz:push_image
+      run: bazel run --stamp --embed_label=${{ github.ref_name }} --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc //authz:push_image
 
     - name: Push envoy image to ghcr.io
-      run: bazel run --stamp --embed_label=${{ github.ref_name }} //envoy:push_image
+      run: bazel run --stamp --embed_label=${{ github.ref_name }} --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc //envoy:push_image