diff --git a/.github/workflows/module_tests.yml b/.github/workflows/module_tests.yml
index bd9a3f1f718..6bef9e79f57 100644
--- a/.github/workflows/module_tests.yml
+++ b/.github/workflows/module_tests.yml
@@ -16,6 +16,10 @@
 name: Module Tests
 on:
   workflow_call:
+    secrets:
+      UBUNTU_SNAPSHOT_MIRROR_URL:
+        description: Optional StableBuild mirror tag used before snapshot.ubuntu.com (see the Bazel downloader step).
+        required: false
   workflow_dispatch:
 permissions:
   contents: read
@@ -61,6 +65,24 @@ jobs:
           disk-cache: ${{ github.workflow }}-${{ matrix.module }}
           repository-cache: true
           cache-save: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+      - name: Configure optional Ubuntu snapshot mirror for Bazel downloader
+        env:
+          UBUNTU_SNAPSHOT_MIRROR_URL: ${{ secrets.UBUNTU_SNAPSHOT_MIRROR_URL }}
+        run: |
+          # snapshot.ubuntu.com is unreliable. If a mirror is configured, try it first and keep the
+          # public URL as fallback. ~/.bazelrc applies to every module workspace, unlike user.bazelrc.
+          if [[ -z "${UBUNTU_SNAPSHOT_MIRROR_URL}" ]]; then
+            echo "No Ubuntu snapshot mirror configured; using snapshot.ubuntu.com."
+            exit 0
+          fi
+          mirror="${UBUNTU_SNAPSHOT_MIRROR_URL}.debmirror.stablebuild.com/2026-04-01T10:40:01Z"
+          cfg="${RUNNER_TEMP}/ubuntu.downloader_config"
+          {
+            echo "rewrite snapshot.ubuntu.com/ubuntu/[^/]*/(.*) ${mirror}/archive.ubuntu.com/ubuntu/\$1"
+            echo "rewrite snapshot.ubuntu.com/ubuntu/[^/]*/(.*) ${mirror}/ports.ubuntu.com/\$1"
+            echo "rewrite snapshot.ubuntu.com/ubuntu/(.*) snapshot.ubuntu.com/ubuntu/\$1"
+          } > "${cfg}"
+          echo "common --downloader_config=${cfg}" >> "${HOME}/.bazelrc"
       - name: Run module tests
         run: python3 scripts/module_tests.py run ${{ matrix.module }}
       - name: Upload test reports and coverage
diff --git a/.github/workflows/test_and_docs.yml b/.github/workflows/test_and_docs.yml
index 604dd58cdc7..a1521dd99e3 100644
--- a/.github/workflows/test_and_docs.yml
+++ b/.github/workflows/test_and_docs.yml
@@ -35,6 +35,7 @@ env:
 jobs:
   module_tests:
     uses: ./.github/workflows/module_tests.yml
+    secrets: inherit
   test_and_docs:
     runs-on: ubuntu-24.04
     needs: module_tests