diff --git a/.github/actions/build/action.yaml b/.github/actions/build/action.yaml
index e67c4b93a62fd..5d9fcd477b8d2 100644
--- a/.github/actions/build/action.yaml
+++ b/.github/actions/build/action.yaml
@@ -25,9 +25,6 @@ runs:
           echo "target_os=['android']" >> .gclient
           gclient validate
         shell: bash
-      - name: CIPD auth
-        run: cipd auth-login -service-account-json :gce
-        shell: bash
       - name: gclient sync
         run: gclient sync -v --shallow --no-history -r ${{ github.sha }}
         shell: bash
diff --git a/buildtools/reclient_cfgs/fetch_reclient_cfgs.py b/buildtools/reclient_cfgs/fetch_reclient_cfgs.py
index 6470fe0bf9406..fc6b2d5e82f2e 100755
--- a/buildtools/reclient_cfgs/fetch_reclient_cfgs.py
+++ b/buildtools/reclient_cfgs/fetch_reclient_cfgs.py
@@ -48,6 +48,9 @@ class CipdError(Exception):
 def CipdEnsure(pkg_name, ref, directory, quiet):
     logging.info('ensure %s %s in %s' % (pkg_name, ref, directory))
     log_level = 'warning' if quiet else 'debug'
+    auth = []
+    if os.getenv('IS_CI', default='0') == '1':
+        auth = ['-service-account-json', ':gce']
     ensure_file = """
 $ParanoidMode CheckPresence
 {pkg} {ref}
@@ -55,7 +58,7 @@ def CipdEnsure(pkg_name, ref, directory, quiet):
     try:
       output = subprocess.check_output(
           ' '.join(['cipd', 'ensure', '-log-level=' + log_level,
-                    '-root', directory, '-ensure-file', '-', '-service-account-json', ':gce']),
+                    '-root', directory, '-ensure-file', '-'] + auth),
           shell=True, input=ensure_file, stderr=subprocess.STDOUT,
           universal_newlines=True)
       logging.info(output)