diff --git a/build/ci/Dockerfile b/build/ci/Dockerfile
index e319026..d3f3f80 100644
--- a/build/ci/Dockerfile
+++ b/build/ci/Dockerfile
@@ -49,6 +49,17 @@
 # https://github.com/bazelbuild/bazel-gazelle/pull/535
 ENV GO_REPOSITORY_USE_HOST_CACHE=1
 
+# Install ibazel (bazel-watcher)
+RUN set -e -x ;\
+    cd /tmp ;\
+    git clone -b v0.15.10 https://github.com/bazelbuild/bazel-watcher ;\
+    cd bazel-watcher ;\
+    [ $(git rev-parse HEAD) == "84cab6f15f64850fb972ea88701e634c8b611301" ] ;\
+    bazel --output_user_root /tmp/bazel-watcher-cache build //ibazel ;\
+    cp bazel-bin/ibazel/linux_amd64_stripped/ibazel /usr/local/bin/ibazel ;\
+    cd /tmp ;\
+    rm -rf bazel-watcher bazel-watcher-cache
+
 # --userns=keep-id uses the workdir as $HOME otherwise
 RUN mkdir /user
 ENV HOME=/user
diff --git a/scripts/bin/ibazel b/scripts/bin/ibazel
new file mode 100755
index 0000000..3c32571
--- /dev/null
+++ b/scripts/bin/ibazel
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ibazel doesn't take a --output_user_root, set it using the per-user .bazelrc inside the container.
+podman exec -i monogon-dev bash -c "cat - > /user/.bazelrc" <<EOF
+startup --output_user_root ${HOME}/.cache/bazel-monogon
+EOF
+
+exec podman exec -it monogon-dev ibazel "$@"