diff --git a/.bazelrc b/.bazelrc
index ffe7f45f25..a5b9664ce6 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -87,6 +87,11 @@ build:macos --host_copt=-Wno-deprecated-declarations
 build:macos --host_copt=-Wno-stringop-overread
 build:macos --host_copt=-Wno-sign-compare
 
+# BuildBuddy's managed cloud pool only has Linux executors; disable remote
+# execution on macOS and Windows while keeping BES and remote caching enabled.
+common:macos --remote_executor=
+common:windows --remote_executor=
+
 import %workspace%/specialized_configs.bazelrc
 import %workspace%/buildbuddy.bazelrc
 
diff --git a/.github/actions/setup-bazel/action.yaml b/.github/actions/setup-bazel/action.yaml
index 2938ca3515..6e7e49e291 100644
--- a/.github/actions/setup-bazel/action.yaml
+++ b/.github/actions/setup-bazel/action.yaml
@@ -36,8 +36,7 @@ runs:
           # pyrefly toolchain or type-check targets before running them.
           build --output_groups=-pyrefly
           build --//python/config_settings:py_pbs_distribution=install_only_stripped
-          # BuildBuddy RBE workers are Linux x86_64; only enable on Linux.
-          ${{ runner.os == 'Linux' && inputs.buildbuddy_api_key && format('common --config={0}', inputs.buildbuddy_config) || '' }}
+          ${{ inputs.buildbuddy_api_key && format('common --config={0}', inputs.buildbuddy_config) || '' }}
 
     # setup-bazel only configures Bazelisk and restores caches; the Bazel
     # binary itself is downloaded by Bazelisk on first invocation. Because
@@ -51,7 +50,7 @@ runs:
     # passing it via environment variables or CLI args, keeping it out of
     # process tables and child environments.
     - name: Write secret to user.bazelrc
-      if: ${{ runner.os == 'Linux' && inputs.buildbuddy_api_key != '' }}
+      if: ${{ inputs.buildbuddy_api_key != '' }}
       uses: actions/github-script@v7
       with:
         script: |
diff --git a/BUILD.bazel b/BUILD.bazel
index 1e555d5123..71cdb82325 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -60,8 +60,10 @@ exports_files([
 
 exports_files(
     [
+        ".bazelrc",
         ".bazelversion",
         "MODULE.bazel",
+        "buildbuddy.bazelrc",
     ],
     visibility = ["//tests:__subpackages__"],
 )
diff --git a/buildbuddy.bazelrc b/buildbuddy.bazelrc
index 4c031775d7..861e70e2cd 100644
--- a/buildbuddy.bazelrc
+++ b/buildbuddy.bazelrc
@@ -8,6 +8,12 @@ build:_buildbuddy_base --bes_backend=grpcs://rules-python.buildbuddy.io
 common:_buildbuddy_base --remote_cache=grpcs://rules-python.buildbuddy.io
 common:_buildbuddy_base --remote_timeout=10m
 common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io
+# Re-apply `--enable_platform_specific_config` after setting `--remote_executor`
+# so `common:macos` and `common:windows` in `.bazelrc` inherit the priority of
+# `--config=buildbuddy_*` (e.g. when set in `~/.bazelrc` by `setup-bazel`,
+# which has higher priority than `.bazelrc`'s top-level
+# `--enable_platform_specific_config`).
+common:_buildbuddy_base --enable_platform_specific_config
 
 # For PR presubmit runs.
 # Requires a BuildBuddy CAS-only API key.
diff --git a/tests/workflows/BUILD.bazel b/tests/workflows/BUILD.bazel
index ab5573a249..41f0927fbf 100644
--- a/tests/workflows/BUILD.bazel
+++ b/tests/workflows/BUILD.bazel
@@ -82,6 +82,8 @@ pytest_test(
     name = "setup_bazel_test",
     srcs = ["setup_bazel_test.py"],
     data = [
+        "//:.bazelrc",
+        "//:buildbuddy.bazelrc",
         "//.github/actions/setup-bazel:all_files",
     ],
     target_compatible_with = NOT_WINDOWS,
diff --git a/tests/workflows/setup_bazel_test.py b/tests/workflows/setup_bazel_test.py
index 335c53e0ca..ba04a964c4 100644
--- a/tests/workflows/setup_bazel_test.py
+++ b/tests/workflows/setup_bazel_test.py
@@ -40,16 +40,46 @@ def test_action_yaml_invokes_executable_download_script():
     assert any("download_bazel.sh" in step.get("run", "") for step in steps)
 
 
-def test_action_yaml_enables_buildbuddy_only_on_linux():
-    """Verifies setup-bazel action.yaml only enables BuildBuddy on Linux."""
+def test_action_yaml_enables_buildbuddy_on_all_os():
+    """Verifies setup-bazel action.yaml enables BuildBuddy across all OSes."""
     action = yaml.safe_load((_action_dir() / "action.yaml").read_text(encoding="utf-8"))
     steps = action["runs"]["steps"]
     setup_step = next(s for s in steps if s.get("name") == "Setup Bazel")
-    assert "runner.os == 'Linux'" in setup_step["with"]["bazelrc"]
+    assert "inputs.buildbuddy_api_key" in setup_step["with"]["bazelrc"]
+    assert "runner.os" not in setup_step["with"]["bazelrc"]
     secret_step = next(
         s for s in steps if s.get("name") == "Write secret to user.bazelrc"
     )
-    assert "runner.os == 'Linux'" in secret_step["if"]
+    assert secret_step["if"] == "${{ inputs.buildbuddy_api_key != '' }}"
+
+
+def test_buildbuddy_bazelrc_disables_remote_executor_on_macos_and_windows():
+    """Verifies .bazelrc and buildbuddy.bazelrc disable remote_executor on macOS and Windows."""
+    rf = runfiles.CreateOrRaise()
+    buildbuddy_path = rf.root() / "rules_python/buildbuddy.bazelrc"
+    buildbuddy_lines = [
+        line.strip()
+        for line in buildbuddy_path.read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.strip().startswith("#")
+    ]
+    executor_line = (
+        "common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io"
+    )
+    platform_config_line = "common:_buildbuddy_base --enable_platform_specific_config"
+    assert executor_line in buildbuddy_lines
+    assert platform_config_line in buildbuddy_lines
+    assert buildbuddy_lines.index(executor_line) < buildbuddy_lines.index(
+        platform_config_line
+    )
+
+    bazelrc_path = rf.root() / "rules_python/.bazelrc"
+    bazelrc_lines = [
+        line.strip()
+        for line in bazelrc_path.read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.strip().startswith("#")
+    ]
+    assert "common:macos --remote_executor=" in bazelrc_lines
+    assert "common:windows --remote_executor=" in bazelrc_lines
 
 
 def test_download_bazel_succeeds_first_try(tmp_path: Path):