diff --git a/.github/actions/configure_bazelrc/action.yaml b/.github/actions/configure_bazelrc/action.yaml
new file mode 100644
index 000000000..ad72a50bb
--- /dev/null
+++ b/.github/actions/configure_bazelrc/action.yaml
@@ -0,0 +1,37 @@
+name: Configure bazelrc file and copy to $HOME/.bazelrc
+
+inputs:
+  bazelrc_path:
+    type: string
+    description: The path to the bazelrc file to use as the starting point.
+    default: '.bazelrc.ci'
+  buildbuddy_api_key:
+    type: string
+    description: Buildbuddy API key
+
+runs:
+  using: composite
+  steps:
+    - id: create_bazelrc_tmp
+      shell: bash
+      env:
+        BAZELRC: ${{ inputs.bazelrc_path }}
+      run: |
+        bazelrc_tmp="${BAZELRC}.tmp"
+        cp "${BAZELRC}" "${bazelrc_tmp}"
+        echo "bazelrc_tmp=${bazelrc_tmp}" >> "$GITHUB_OUTPUT"
+    - uses: tweag/configure-bazel-remote-cache-auth@v0
+      with:
+        buildbuddy_api_key: ${{ inputs.buildbuddy_api_key }}
+        bazelrc_path: ${{ steps.create_bazelrc_tmp.outputs.bazelrc_tmp }}
+
+    - shell: bash
+      env:
+        BAZELRC_TMP: ${{ steps.create_bazelrc_tmp.outputs.bazelrc_tmp }}
+      run: |
+        cat >>"${BAZELRC_TMP}" <<EOF
+        common --config=ci
+        # no-op flag to avoid "ERROR: Config value 'ci' is not defined in any .rc file"
+        common:ci --announce_rc=false
+        EOF
+        cp "${BAZELRC_TMP}" $HOME/.bazelrc
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index e56d0c427..799f440a9 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -39,22 +39,9 @@ jobs:
       - uses: cachix/install-nix-action@v24
         with:
           nix_path: nixpkgs=./docs/nixpkgs.nix
-      - name: Configure
-        env:
-          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
-        run: |
-          cp .bazelrc.ci $HOME/.bazelrc
-          if [ -z "$BUILDBUDDY_API_KEY" ]; then
-              cache_setting='build --noremote_upload_local_results'
-          else
-              cache_setting="build --remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          fi
-          cat >>$HOME/.bazelrc <<EOF
-          common --config=ci
-          $cache_setting
-          # no-op flag to avoid "ERROR: Config value 'ci' is not defined in any .rc file"
-          common:ci --announce_rc=false
-          EOF
+      - uses: ./.github/actions/configure_bazelrc
+        with:
+          buildbuddy_api_key: ${{ secrets.BUILDBUDDY_API_KEY }}
       - name: Start remote Nix server
         if: matrix.withNixRemote && matrix.os == 'ubuntu-latest'
         run: |
@@ -98,23 +85,9 @@ jobs:
       - uses: cachix/install-nix-action@v24
         with:
           nix_path: nixpkgs=./nixpkgs.nix
-      - name: Configure
-        env:
-          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
-        run: |
-          cp .bazelrc.ci $HOME/.bazelrc
-          cp .bazelrc.ci $HOME/.bazelrc
-          if [ -z "$BUILDBUDDY_API_KEY" ]; then
-              cache_setting='build --noremote_upload_local_results'
-          else
-              cache_setting="build --remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          fi
-          cat >>$HOME/.bazelrc <<EOF
-          common --config=ci
-          $cache_setting
-          # no-op flag to avoid "ERROR: Config value 'ci' is not defined in any .rc file"
-          common:ci --announce_rc=false
-          EOF
+      - uses: ./.github/actions/configure_bazelrc
+        with:
+          buildbuddy_api_key: ${{ secrets.BUILDBUDDY_API_KEY }}
       - name: Build & test
         run: |
           skip() {