diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
new file mode 100644
index 000000000..3e3f878d1
--- /dev/null
+++ b/.github/workflows/bazel.yml
@@ -0,0 +1,23 @@
+name: Bazel CI
+on:
+  push:
+    branches: [sdf15, main]
+  pull_request:
+    branches: [sdf15, main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    uses: bazel-contrib/.github/.github/workflows/bazel.yaml@v7
+    with:
+      folders: |
+        [
+          ".",
+        ]
+      exclude: |
+        [
+          {"folder": ".", "bzlmodEnabled": false},
+        ]
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
new file mode 100644
index 000000000..3b4aad2af
--- /dev/null
+++ b/.github/workflows/ci.bazelrc
@@ -0,0 +1,15 @@
+# This file contains Bazel settings to apply on CI only.
+# It is referenced with a --bazelrc option in the call to bazel in ci.yaml
+
+# Debug where options came from
+build --announce_rc
+# This directory is configured in GitHub actions to be persisted between runs.
+# We do not enable the repository cache to cache downloaded external artifacts
+# as these are generally faster to download again than to fetch them from the
+# GitHub actions cache.
+build --disk_cache=~/.cache/bazel
+# Don't rely on test logs being easily accessible from the test runner,
+# though it makes the log noisier.
+test --test_output=errors
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+test --test_env=XDG_CACHE_HOME