diff --git a/build/bazel/bazel_downloader.cfg b/build/bazel/bazel_downloader.cfg
index bdbad08..92a7e1d 100644
--- a/build/bazel/bazel_downloader.cfg
+++ b/build/bazel/bazel_downloader.cfg
@@ -5,9 +5,12 @@
 # bzlmod deps.
 allow bcr.bazel.build
 
+# Allow requests to api.github.com for finding submodule refs.
+allow api.github.com
+
 # Allow requests to our mirror and rewrite all urls to use said mirror.
 allow mirror.monogon.dev
-rewrite ^((?!go\.dev|bcr\.bazel\.build).*) mirror.monogon.dev/$1
+rewrite ^((?!go\.dev|bcr\.bazel\.build|api\.github\.com).*) mirror.monogon.dev/$1
 
 # Block all other URLs. You can comment out this one to allow a fallback.
 block *