diff --git a/.bazelrc b/.bazelrc
index beffe3f..7144d1d 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,3 +1,5 @@
+try-import %workspace%/.bazelrc.ci
+
 test --sandbox_default_allow_network=false
 test --test_output=errors
 
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1aa5f6b..09cdc1d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -18,38 +18,42 @@ jobs:
         os: [windows-latest, ubuntu-latest, macos-13, macos-14]
     runs-on: ${{ matrix.os }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
       - uses: actions/cache@v4
         name: "Windows: cache bazelisk and zig-cache"
         if: runner.os == 'Windows'
         with:
           key: cache-${{ runner.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            'C:\Temp\hermetic_cc_toolchain'
-            '~\AppData\Local\bazelisk'
+            C:\Temp\hermetic_cc_toolchain
+            ~\AppData\Local\bazelisk'
       - uses: actions/cache@v4
         name: "MacOS: cache bazelisk and zig-cache"
         if: runner.os == 'macOS'
         with:
           key: cache-${{ runner.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            '/tmp/zig-cache'
-            '~/Library/Caches/bazelisk'
+            /tmp/zig-cache
+            ~/Library/Caches/bazelisk
       - uses: actions/cache@v4
         name: "Linux: cache bazelisk and zig-cache"
-        if: runner.os == 'macOS'
+        if: runner.os == 'Linux'
         with:
           key: cache-${{ runner.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            '/tmp/zig-cache'
-            '~/.cache/bazelisk'
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          fetch-tags: true
+            /tmp/zig-cache
+            ~/.cache/bazelisk
 
       - run: brew install bash
         if: runner.os == 'macOS'
 
+      - run: echo "common --announce_rc" >> .bazelrc.ci
+      - run: echo "build --sandbox_add_mount_pair=C:\\Temp" >> .bazelrc.ci
+        if: runner.os == 'Windows'
+
       # Linux, macOS and Windows
       - run: ci/list_toolchains_platforms
       - run: ci/zig-utils