diff --git a/.bazelrc b/.bazelrc
index 24aba939a6..ffe7f45f25 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -88,5 +88,6 @@ build:macos --host_copt=-Wno-stringop-overread
 build:macos --host_copt=-Wno-sign-compare
 
 import %workspace%/specialized_configs.bazelrc
+import %workspace%/buildbuddy.bazelrc
 
 try-import user.bazelrc
diff --git a/buildbuddy.bazelrc b/buildbuddy.bazelrc
new file mode 100644
index 0000000000..4c031775d7
--- /dev/null
+++ b/buildbuddy.bazelrc
@@ -0,0 +1,23 @@
+# Shared base config for BuildBuddy RBE and BES.
+# Prefixed with `_` because it should not be used directly; use
+# `--config=buildbuddy_presubmit` or `--config=buildbuddy_postsubmit` instead.
+# API keys (`--remote_header=x-buildbuddy-api-key=...`) must be configured in
+# `user.bazelrc` or passed by CI.
+build:_buildbuddy_base --bes_results_url=https://rules-python.buildbuddy.io/invocation/
+build:_buildbuddy_base --bes_backend=grpcs://rules-python.buildbuddy.io
+common:_buildbuddy_base --remote_cache=grpcs://rules-python.buildbuddy.io
+common:_buildbuddy_base --remote_timeout=10m
+common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io
+
+# For PR presubmit runs.
+# Requires a BuildBuddy CAS-only API key.
+common:buildbuddy_presubmit --config=_buildbuddy_base
+# Isolate presubmit cache so untrusted PRs cannot poison the postsubmit cache.
+common:buildbuddy_presubmit --remote_instance_name=presubmit
+# A CAS-only key doesn't allow uploading locally generated results.
+common:buildbuddy_presubmit --remote_upload_local_results=false
+
+# For postsubmit CI runs on committed code.
+# Requires a BuildBuddy read+write API key.
+common:buildbuddy_postsubmit --config=_buildbuddy_base
+common:buildbuddy_postsubmit --remote_upload_local_results=true