diff --git a/.github/workflows/_bazel.yml b/.github/workflows/_bazel.yml
index e70d6c032..b3d053cd5 100644
--- a/.github/workflows/_bazel.yml
+++ b/.github/workflows/_bazel.yml
@@ -80,7 +80,7 @@ jobs:
         BAZELRC_CONTENT: ${{ vars.TOOLSHED_CI_BAZELRC }}
     - name: RBE auth check
       id: rbe
-      if: inputs.rbe == 'true'
+      if: inputs.rbe && github.event_name == 'pull_request'
       uses: envoyproxy/toolshed/actions/github/container/auth@f3c0acc8c3799305101f5669042b388edfb070c7
       with:
         container: hello-world
@@ -89,7 +89,7 @@ jobs:
       run: >-
         exec bazel ${{ inputs.action }}
         ${{ inputs.bazel-args }}
-        ${{ steps.rbe.outputs.authorized == 'true' && '--config=rbe' || '' }}
+        ${{ (steps.rbe.outputs.authorized == 'true' || github.event_name != 'pull_request') && '--config=rbe' || '' }}
         ${{ inputs.targets }}
       working-directory: ${{ inputs.bazel-path }}
       env:
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index a2f3a9b57..1d81d386d 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -147,6 +147,7 @@ jobs:
       uses: bazelbuild/setup-bazelisk@b39c379c82683a5f25d34f0d062761f62693e0b2  # v3
     - name: RBE auth check
       id: rbe
+      if: github.event_name == 'pull_request'
       uses: envoyproxy/toolshed/actions/github/container/auth@f3c0acc8c3799305101f5669042b388edfb070c7
       with:
         container: hello-world
@@ -163,7 +164,7 @@ jobs:
         exec bazel build
         --config=ci
         --config=macos
-        ${{ steps.rbe.outputs.authorized == 'true' && '--config=rbe-cache-only' || '' }}
+        ${{ (steps.rbe.outputs.authorized == 'true' || github.event_name != 'pull_request') && '--config=rbe-cache-only' || '' }}
         ${{ matrix.mode == 'bzlmod' && '--enable_bzlmod' || '' }}
         //...
       working-directory: bazel