diff --git a/src/global-agent-rules.ts b/src/global-agent-rules.ts
index 791923c..36e6b56 100644
--- a/src/global-agent-rules.ts
+++ b/src/global-agent-rules.ts
@@ -360,6 +360,11 @@ export const globalAgentInstructionSourceInputs: InstructionSourceInput[] = [
       "",
       "Use Codewith native /loop and built-in schedule or loop tools when the user asks for Codewith recurring work. OpenLoops is a separate package; do not call native Codewith loops OpenLoops.",
       "",
+      "For the Codewith app, heavy Rust and Bazel builds are remote by default, not local. Use remote execution or CI for Rust/Bazel verification: GitHub Actions is the canonical remote validation path for workflow and platform gates, and BuildBuddy remote cache/RBE is the Bazel offload path for Bazel-focused Linux or offload work.",
+      "Local builds are allowed only as explicitly human-approved exceptions for the task. Without that approval, local execution is limited to tiny or lightweight non-build checks.",
+      "Remote-build setup must not expose secrets. Use `BUILDBUDDY_API_KEY` as the local environment variable and GitHub secret name. The local vault key path is `hasnaxyz/buildbudd/api-key`; reference only that path name and never print, log, paste, or commit the value.",
+      "When configuring Codewith Bazel verification, prefer the existing upstream BuildBuddy settings in `.bazelrc` and the wrapper `.github/scripts/run_bazel_with_buildbuddy.py` when they fit the workflow.",
+      "",
       "If Codewith dispatch, task routing, or profile support fails, repair the owning package or workflow path. Do not paste prompts into tmux panes unless the human explicitly authorizes the legacy emergency route.",
     ]),
     owner: { kind: "provider", id: "codewith", name: "Codewith" },
@@ -370,6 +375,8 @@ export const globalAgentInstructionSourceInputs: InstructionSourceInput[] = [
       "provider:codewith:native-goals",
       "provider:codewith:goal-plan-adversarial-steps",
       "provider:codewith:native-loops",
+      "provider:codewith:remote-rust-bazel-builds",
+      "provider:codewith:buildbuddy-secret-safety",
       "provider:codewith:no-tmux-fallback",
     ],
     targetProviders: ["codewith"],
diff --git a/src/index.test.ts b/src/index.test.ts
index c32f4a9..efbf145 100644
--- a/src/index.test.ts
+++ b/src/index.test.ts
@@ -913,6 +913,18 @@ describe("open-identities", () => {
     expect(codewithSources.map((source) => source.content ?? "").join("\n")).toContain(noBrittleHardcodingRule);
     expect(codewithSources.find((source) => source.id === "hasna-codewith-global-agent-overlay")?.content).not.toContain(budgetRule);
     expect(codewithSources.find((source) => source.id === "hasna-codewith-global-agent-overlay")?.content).not.toContain(noBrittleHardcodingRule);
+    const codewithOverlay = codewithSources.find((source) => source.id === "hasna-codewith-global-agent-overlay");
+    expect(codewithOverlay?.content).toContain("heavy Rust and Bazel builds are remote by default, not local");
+    expect(codewithOverlay?.content).toContain("GitHub Actions is the canonical remote validation path");
+    expect(codewithOverlay?.content).toContain("BuildBuddy remote cache/RBE is the Bazel offload path");
+    expect(codewithOverlay?.content).toContain("Local builds are allowed only as explicitly human-approved exceptions");
+    expect(codewithOverlay?.content).toContain("BUILDBUDDY_API_KEY");
+    expect(codewithOverlay?.content).toContain("hasnaxyz/buildbudd/api-key");
+    expect(codewithOverlay?.content).toContain(".github/scripts/run_bazel_with_buildbuddy.py");
+    expect(codewithOverlay?.ruleIds).toEqual(expect.arrayContaining([
+      "provider:codewith:remote-rust-bazel-builds",
+      "provider:codewith:buildbuddy-secret-safety",
+    ]));
 
     const antigravitySources = listGlobalAgentInstructionSources({ providers: ["antigravity"] });
     expect(antigravitySources.map((source) => source.id)).toEqual([