diff --git a/.bazelrc b/.bazelrc
index 28ef64f61..dff2e7fa3 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -77,6 +77,8 @@ common:bb --remote_cache=grpcs://remote.buildbuddy.io
 common:bb --remote_cache_compression
 common:bb --remote_timeout=10m
 common:bb --credential_helper=remote.buildbuddy.io=%workspace%/tools/buildbuddy-credential-helper.sh
+common:bb-ro --config=bb
+common:bb-ro --noremote_upload_local_results
 common:ci --remote_cache=grpcs://remote.buildbuddy.io
 common:ci --experimental_remote_downloader=grpcs://remote.buildbuddy.io
 common:ci --experimental_remote_downloader_local_fallback
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 019732718..3b5cf2be1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -31,6 +31,8 @@ tools/dx test --affected -- --config=bb
 
 `--config=bb` reads the key from the environment through `tools/buildbuddy-credential-helper.sh` on Linux and macOS. Never put the key in `user.bazelrc` or any other rc file, and never pass `--announce_rc`.
 
+A read-only key makes Bazel warn on every build that it cannot upload results. Use `--config=bb-ro` instead of `--config=bb`.
+
 ## Issues and labels
 
 Use the bug template. Paste `dx status`.
diff --git a/cli/cli/src/main.rs b/cli/cli/src/main.rs
index 76bd478fc..b1a52a1be 100644
--- a/cli/cli/src/main.rs
+++ b/cli/cli/src/main.rs
@@ -8,7 +8,7 @@
     )
 )]
 
-use std::io::{self, Write};
+use std::io::{self, IsTerminal, Write};
 use std::path::Path;
 
 use dx_cli::bazel_restart::{RestartingQueryRunner, RestartingRunner};
@@ -248,6 +248,7 @@ fn run() -> i32 {
             return usage_error(code, &error.to_string(), json, command);
         }
     };
+    invocation.piped = !io::stdout().is_terminal();
     // LCOV_EXCL_STOP - reason: end thin run shim, issue: 1055, policy: docs/cli/commands/build-test-coverage.md
     dx_adopt::refresh_stale_pins_from_env();
     dx_cli::exec::set_usage_command(invocation.command);
diff --git a/cli/plan/src/args/invocation.rs b/cli/plan/src/args/invocation.rs
index cbc26eaa4..f9fef306b 100644
--- a/cli/plan/src/args/invocation.rs
+++ b/cli/plan/src/args/invocation.rs
@@ -334,6 +334,8 @@ pub struct Invocation {
     pub bench_compare: Option<String>,
     pub path_only: bool,
     pub agent: bool,
+    /// Stdout is not a terminal.
+    pub piped: bool,
     pub bazel_startup_options: Vec<String>,
 }
 
@@ -352,9 +354,10 @@ impl Invocation {
         self.command == Command::Update && self.targets.len() == 2 && is_version(&self.targets[1])
     }
 
-    /// Bazel UI flags that silence progress output in agent JSON sessions.
+    /// Bazel UI flags that silence progress output in agent JSON sessions and piped runs; `-v` keeps Bazel output.
     pub fn agent_quiet_flags(&self) -> Vec<String> {
-        if self.agent && self.output == OutputMode::Json {
+        let agent_json = self.agent && self.output == OutputMode::Json;
+        if (agent_json || self.piped) && !self.verbose {
             AGENT_QUIET_FLAGS
                 .iter()
                 .map(|flag| (*flag).to_owned())
@@ -364,7 +367,7 @@ impl Invocation {
         }
     }
 
-    /// Bazel options for the run: agent JSON sessions get no progress output.
+    /// Bazel options for the run: agent JSON sessions and piped runs get no progress output.
     pub fn quiet_bazel_options(&self) -> Vec<String> {
         let mut options = self.agent_quiet_flags();
         options.extend(self.bazel_options.iter().cloned());
@@ -743,6 +746,7 @@ mod tests {
             bench_compare: None,
             path_only: false,
             agent: false,
+            piped: false,
             bazel_startup_options: Vec::new(),
         }
     }
@@ -1117,6 +1121,16 @@ mod tests {
         AGENT_QUIET_FLAGS.iter().map(ToString::to_string).collect()
     }
 
+    #[test]
+    fn piped_runs_are_quiet_unless_verbose() {
+        let mut inv = parsed(&["build"]);
+        assert!(inv.quiet_bazel_options().is_empty());
+        inv.piped = true;
+        assert_eq!(inv.quiet_bazel_options(), quiet_flags());
+        inv.verbose = true;
+        assert!(inv.quiet_bazel_options().is_empty());
+    }
+
     #[test]
     fn raw_bazel_options_never_carry_agent_quiet_flags() {
         let session = agent(&["build", "--output=json", "--", "--jobs=4"]);
diff --git a/cli/plan/src/args/parser.rs b/cli/plan/src/args/parser.rs
index 1d40f507c..fc5a47e94 100644
--- a/cli/plan/src/args/parser.rs
+++ b/cli/plan/src/args/parser.rs
@@ -747,6 +747,7 @@ fn parse_inner<S: AsRef<OsStr>>(
         bench_compare: compare,
         path_only,
         agent,
+        piped: false,
         bazel_startup_options,
     })
 }
diff --git a/docs/cli/commands/build-test-coverage.md b/docs/cli/commands/build-test-coverage.md
index 46fee4956..48a184c30 100644
--- a/docs/cli/commands/build-test-coverage.md
+++ b/docs/cli/commands/build-test-coverage.md
@@ -46,6 +46,8 @@ dx coverage [--here] [--affected] [--timings] [--min-coverage <percent>] [--min-
 
 `--debug` and `--release` conflict. Both change compilation only.
 
+When stdout is not a terminal, dx passes Bazel the quiet flags `--noshow_progress`, `--noshow_loading_progress`, `--noshow_timestamps`, `--curses=no`, `--ui_event_filters=-info,-debug` and `--test_summary=none`. `-v` keeps full Bazel output.
+
 ## Scopes
 
 No scope means `//...`. Pass labels, patterns, files, or directories. A file runs its owning targets. For `test` and `coverage`, a file runs the tests that depend on its owners. A `manual` test runs only when it owns the file.
diff --git a/docs/remote-cache.md b/docs/remote-cache.md
index eb6d8b2f0..a435513ed 100644
--- a/docs/remote-cache.md
+++ b/docs/remote-cache.md
@@ -38,6 +38,13 @@ Pass the config after `--`.
 dx build //... -- --config=cache
 ```
 
+A read-only key makes Bazel warn that the cache does not accept uploads. Add a config that turns uploads off and use it with that key.
+
+```text
+common:cache-ro --config=cache
+common:cache-ro --noremote_upload_local_results
+```
+
 `dx` still adds its shared disk cache locally, so Bazel uses both caches. Under `CI=true`, `dx` adds no disk cache.
 
 ## Backends