diff --git a/.github/actions/setup-bazel/action.yaml b/.github/actions/setup-bazel/action.yaml
new file mode 100644
index 0000000000..5a6ed46f15
--- /dev/null
+++ b/.github/actions/setup-bazel/action.yaml
@@ -0,0 +1,26 @@
+name: "Setup Bazel"
+description: "Configure Bazel with caching for GitHub Actions workflows"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Bazel
+      uses: bazel-contrib/setup-bazel@0.19.0
+      with:
+        bazelisk-cache: true
+        disk-cache: true
+        # Files hashed to compute the repository cache key. If only `true` is
+        # passed, only MODULE.bazel/WORKSPACE* are hashed, so lockfile-only
+        # updates would get a cache hit on the old key and skip saving newly
+        # downloaded wheels.
+        repository-cache: |
+          - MODULE.bazel
+          - dev/requirements.txt
+          - dev/uv.lock
+          - tools/publish/requirements_linux.txt
+        bazelrc: |
+          # .bazelrc enables --config=pyrefly by default; disable the pyrefly
+          # output group here so operational workflows don't download the
+          # pyrefly toolchain or type-check targets before running them.
+          build --output_groups=-pyrefly
+          build --//python/config_settings:py_pbs_distribution=install_only_stripped
diff --git a/.github/workflows/backport_create_releases.yaml b/.github/workflows/backport_create_releases.yaml
index 15975437b8..d6766251bb 100644
--- a/.github/workflows/backport_create_releases.yaml
+++ b/.github/workflows/backport_create_releases.yaml
@@ -29,9 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/backport_prepare.yaml b/.github/workflows/backport_prepare.yaml
index 3db53f6871..d94f3bf213 100644
--- a/.github/workflows/backport_prepare.yaml
+++ b/.github/workflows/backport_prepare.yaml
@@ -41,9 +41,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/on_pr_closed.yaml b/.github/workflows/on_pr_closed.yaml
index 764bfeff63..f6f4b2b0aa 100644
--- a/.github/workflows/on_pr_closed.yaml
+++ b/.github/workflows/on_pr_closed.yaml
@@ -49,9 +49,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/publish_pypi.yaml b/.github/workflows/publish_pypi.yaml
index 44f0a1d9fb..345009325f 100644
--- a/.github/workflows/publish_pypi.yaml
+++ b/.github/workflows/publish_pypi.yaml
@@ -23,6 +23,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag_name || github.ref_name }}
+      - name: Setup Bazel
+        uses: ./.github/actions/setup-bazel
       - env:
           # This special value tells pypi that the user identity is supplied within the token
           TWINE_USERNAME: __token__
diff --git a/.github/workflows/release_add_backports.yaml b/.github/workflows/release_add_backports.yaml
index 60d55939e2..b20fd95480 100644
--- a/.github/workflows/release_add_backports.yaml
+++ b/.github/workflows/release_add_backports.yaml
@@ -35,9 +35,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Add Backports to Tracking Issue
         env:
diff --git a/.github/workflows/release_complete_prepare.yaml b/.github/workflows/release_complete_prepare.yaml
index 5664f68bc3..ccfa98d339 100644
--- a/.github/workflows/release_complete_prepare.yaml
+++ b/.github/workflows/release_complete_prepare.yaml
@@ -47,9 +47,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Mark Prepare Release Complete
         id: complete_prepare
diff --git a/.github/workflows/release_create_rc.yaml b/.github/workflows/release_create_rc.yaml
index e7857f6542..1c6f91738b 100644
--- a/.github/workflows/release_create_rc.yaml
+++ b/.github/workflows/release_create_rc.yaml
@@ -38,9 +38,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_create_release_branch.yaml b/.github/workflows/release_create_release_branch.yaml
index ce6c9c111a..dac263e04a 100644
--- a/.github/workflows/release_create_release_branch.yaml
+++ b/.github/workflows/release_create_release_branch.yaml
@@ -28,9 +28,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_prepare.yaml b/.github/workflows/release_prepare.yaml
index 544826bf49..c714243990 100644
--- a/.github/workflows/release_prepare.yaml
+++ b/.github/workflows/release_prepare.yaml
@@ -29,9 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_process_backports.yaml b/.github/workflows/release_process_backports.yaml
index 16b559a097..483bffdb78 100644
--- a/.github/workflows/release_process_backports.yaml
+++ b/.github/workflows/release_process_backports.yaml
@@ -46,9 +46,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_promote.yaml b/.github/workflows/release_promote.yaml
index 07337e73e2..79b50951ef 100644
--- a/.github/workflows/release_promote.yaml
+++ b/.github/workflows/release_promote.yaml
@@ -34,9 +34,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_sync_changelog.yaml b/.github/workflows/release_sync_changelog.yaml
index 52ced655f1..1389d3d66e 100644
--- a/.github/workflows/release_sync_changelog.yaml
+++ b/.github/workflows/release_sync_changelog.yaml
@@ -29,9 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_sync_changelog_complete.yaml b/.github/workflows/release_sync_changelog_complete.yaml
index 889d6c4c9b..70049eadc5 100644
--- a/.github/workflows/release_sync_changelog_complete.yaml
+++ b/.github/workflows/release_sync_changelog_complete.yaml
@@ -29,9 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |