diff --git a/tools/internal_ci/linux/grpc_bazel_on_foundry_base.sh b/tools/internal_ci/linux/grpc_bazel_on_foundry_base.sh
index dd34eac7b380b82e89601dc5868329132568a19b..93399f81e796bf33d742d5abfdaefc8366820571 100755
--- a/tools/internal_ci/linux/grpc_bazel_on_foundry_base.sh
+++ b/tools/internal_ci/linux/grpc_bazel_on_foundry_base.sh
@@ -15,12 +15,6 @@
 
 set -ex
 
-# A temporary solution to give Kokoro credentials.
-# The file name 4321_grpc-testing-service needs to match auth_credential in
-# the build config.
-mkdir -p ${KOKORO_KEYSTORE_DIR}
-cp ${KOKORO_GFILE_DIR}/GrpcTesting-d0eeee2db331.json ${KOKORO_KEYSTORE_DIR}/4321_grpc-testing-service
-
 # Download bazel
 temp_dir="$(mktemp -d)"
 wget -q https://github.com/bazelbuild/bazel/releases/download/0.23.2/bazel-0.23.2-linux-x86_64 -O "${temp_dir}/bazel"
@@ -45,6 +39,7 @@ bazel \
   test \
   --invocation_id="${BAZEL_INVOCATION_ID}" \
   --workspace_status_command=tools/remote_build/workspace_status_kokoro.sh \
+  --google_credentials="${KOKORO_GFILE_DIR}/GrpcTesting-d0eeee2db331.json" \
   $@ \
   -- //test/... || FAILED="true"
 
diff --git a/tools/internal_ci/windows/bazel_rbe.bat b/tools/internal_ci/windows/bazel_rbe.bat
index e15bce48f0efa9080109f50efe9cf78bd69f4b75..8f2c534c5ef25fe5f45faba2be9b3b24c8a74ad4 100644
--- a/tools/internal_ci/windows/bazel_rbe.bat
+++ b/tools/internal_ci/windows/bazel_rbe.bat
@@ -12,7 +12,20 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 
-choco install bazel -y --version 0.23.2
+@rem TODO(jtattermusch): make this generate less output
+choco install bazel -y --version 0.23.2 --limit-output
+
 cd github/grpc
-set PATH=%PATH%;C:\python27\
-bazel --bazelrc=tools/remote_build/windows.bazelrc build :all --incompatible_disallow_filetype=false --google_credentials=%KOKORO_GFILE_DIR%/rbe-windows-credentials.json
\ No newline at end of file
+set PATH=C:\tools\msys64\usr\bin;C:\Python27;%PATH%
+
+@rem Generate a random UUID and store in "bazel_invocation_ids" artifact file
+powershell -Command "[guid]::NewGuid().ToString()" >%KOKORO_ARTIFACTS_DIR%/bazel_invocation_ids
+set /p BAZEL_INVOCATION_ID=<%KOKORO_ARTIFACTS_DIR%/bazel_invocation_ids
+
+@rem TODO(jtattermusch): windows RBE should be able to use the same credentials as Linux RBE.
+bazel --bazelrc=tools/remote_build/windows.bazelrc build --invocation_id="%BAZEL_INVOCATION_ID%" --workspace_status_command=tools/remote_build/workspace_status_kokoro.sh :all --incompatible_disallow_filetype=false --google_credentials=%KOKORO_GFILE_DIR%/rbe-windows-credentials.json
+set BAZEL_EXITCODE=%errorlevel%
+
+@rem TODO(jtattermusch): upload results to bigquery
+
+exit /b %BAZEL_EXITCODE%
diff --git a/tools/remote_build/kokoro.bazelrc b/tools/remote_build/kokoro.bazelrc
index 2fbdd3ce020ce7b237395dd53fedcc8dc86f6eaf..064e94b2e15a4043f220db61d6b7d90245b25fc6 100644
--- a/tools/remote_build/kokoro.bazelrc
+++ b/tools/remote_build/kokoro.bazelrc
@@ -21,9 +21,6 @@ build --remote_executor=remotebuildexecution.googleapis.com
 build --tls_enabled=true
 
 build --auth_enabled=true
-# magic location where kokoro script puts the credentials
-build --auth_credentials=/tmpfs/src/keystore/4321_grpc-testing-service
-build --auth_scope=https://www.googleapis.com/auth/cloud-source-tools
 
 build --bes_backend=buildeventservice.googleapis.com
 build --bes_timeout=600s