diff --git a/build/bazel/bazel_downloader.cfg b/build/bazel/bazel_downloader.cfg
new file mode 100644
index 0000000..bdbad08
--- /dev/null
+++ b/build/bazel/bazel_downloader.cfg
@@ -0,0 +1,13 @@
+# Allow request to go.dev for finding the current go sdk versions.
+allow go.dev
+
+# Allow requests to the bazel registry for ensuring we can update our
+# bzlmod deps.
+allow bcr.bazel.build
+
+# Allow requests to our mirror and rewrite all urls to use said mirror.
+allow mirror.monogon.dev
+rewrite ^((?!go\.dev|bcr\.bazel\.build).*) mirror.monogon.dev/$1
+
+# Block all other URLs. You can comment out this one to allow a fallback.
+block *