diff --git a/.github/workflows/bazelrc-config.sh b/.github/workflows/bazelrc-config.sh
new file mode 100755
index 000000000..d7713634a
--- /dev/null
+++ b/.github/workflows/bazelrc-config.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e -o pipefail -o nounset
+
+if [ -z "$BUILDBUDDY_API_KEY" ]; then
+    cache_setting='--noremote_upload_local_results'
+else
+    cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
+fi
+
+cat <<EOF
+common --config=ci
+build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
+build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
+build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+build:ci --build_metadata=ROLE=CI
+build $cache_setting
+EOF
diff --git a/.github/workflows/patch-test.yaml b/.github/workflows/patch-test.yaml
index 87b184bb4..e41b86f89 100644
--- a/.github/workflows/patch-test.yaml
+++ b/.github/workflows/patch-test.yaml
@@ -54,10 +54,10 @@ jobs:
             Linux) BUILD_CONFIG=ci-linux-bindist;;
             Windows) BUILD_CONFIG=ci-windows-bindist;;
           esac
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=$BUILD_CONFIG
-          build --remote_header=x-buildbuddy-api-key="$BUILDBUDDY_API_KEY"
+          import %workspace%/.bazelrc.ci
           EOF
           cat >~/.netrc <<EOF
           machine api.github.com
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index eec9f5da4..01a286594 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -41,10 +41,10 @@ jobs:
             macOS) BUILD_CONFIG=ci-macos-nixpkgs;;
             Linux) BUILD_CONFIG=ci-linux-nixpkgs;;
           esac
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=$BUILD_CONFIG
-          build --remote_header=x-buildbuddy-api-key="$BUILDBUDDY_API_KEY"
+          import %workspace%/.bazelrc.ci
           EOF
           cat >~/.netrc <<EOF
           machine api.github.com
@@ -88,15 +88,10 @@ jobs:
           # Avoid failures of the form `deadline exceeded after 14999958197ns DEADLINE_EXCEEDED`.
           # See https://github.com/tweag/rules_haskell/issues/1498 and https://github.com/tweag/rules_haskell/pull/1692.
           sudo sysctl -w net.ipv4.tcp_keepalive_time=60
-          if [ -z "$BUILDBUDDY_API_KEY" ]; then
-              cache_setting='--noremote_upload_local_results'
-          else
-              cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          fi
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=linux-nixpkgs
-          build $cache_setting
+          import %workspace%/.bazelrc.ci
           EOF
           ln -sr .bazelrc.local examples/arm/.bazelrc.local
           cat >~/.netrc <<EOF
@@ -151,15 +146,10 @@ jobs:
             Linux) BUILD_CONFIG=ci-linux-bindist;;
             Windows) BUILD_CONFIG=ci-windows-bindist;;
           esac
-          if [ -z "$BUILDBUDDY_API_KEY" ]; then
-              cache_setting='--noremote_upload_local_results'
-          else
-              cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          fi
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=$BUILD_CONFIG
-          build $cache_setting
+          import %workspace%/.bazelrc.ci
           EOF
           cat >~/.netrc <<EOF
           machine api.github.com
diff --git a/WORKSPACE b/WORKSPACE
index 403247014..f367fcca3 100755
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -489,21 +489,6 @@ haskell_package_repository_dummy(
     name = "haskell_package_repository_dummy",
 )
 
-http_archive(
-    name = "io_bazel_rules_sass",
-    sha256 = "53b42e9dc1c12d18716518a3810780a0131cd513a6d5c828e1eb3fbd30cc0ba6",
-    strip_prefix = "rules_sass-1.44.0",
-    urls = ["https://github.com/bazelbuild/rules_sass/archive/1.44.0.tar.gz"],
-)
-
-load("@io_bazel_rules_sass//:package.bzl", "rules_sass_dependencies")
-
-rules_sass_dependencies()
-
-load("@io_bazel_rules_sass//:defs.bzl", "sass_repositories")
-
-sass_repositories()
-
 http_archive(
     name = "io_bazel_stardoc",
     sha256 = "c9794dcc8026a30ff67cf7cf91ebe245ca294b20b071845d12c192afe243ad72",
diff --git a/tests/run-start-script.sh b/tests/run-start-script.sh
index f6053a2c2..3072eaeb9 100755
--- a/tests/run-start-script.sh
+++ b/tests/run-start-script.sh
@@ -34,6 +34,8 @@ case "$OSTYPE" in
     ;;
 esac
 
+cp "${pwd}/.bazelrc.ci" .bazelrc.local
+
 NIX_PATH=nixpkgs="$pwd/nixpkgs/default.nix" \
   bazel run \
   --config=ci "${OSCONFIG[@]}" \