diff --git a/tools/internal_ci/windows/bazel_rbe.bat b/tools/internal_ci/windows/bazel_rbe.bat
index 827952791c9dbafd8efd50c9a0c1ad1b6bdf9379..86dcc74c42944b5d7890fd03ce25ceb2f5bbc6db 100644
--- a/tools/internal_ci/windows/bazel_rbe.bat
+++ b/tools/internal_ci/windows/bazel_rbe.bat
@@ -14,8 +14,7 @@
 
 @rem TODO(jtattermusch): make this generate less output
 @rem TODO(jtattermusch): use tools/bazel script to keep the versions in sync
-@rem TODO(jtattermusch): https://github.com/bazelbuild/bazel/issues/9369 prevents upgrade to 0.29.1
-choco install bazel -y --version 0.29.0 --limit-output
+choco install bazel -y --version 0.29.1 --limit-output
 
 cd github/grpc
 set PATH=C:\tools\msys64\usr\bin;C:\Python27;%PATH%
diff --git a/tools/remote_build/README.md b/tools/remote_build/README.md
index 2cd5f03daf1842e77ffd7c38c23c8f3fc7f3d0ef..68d68400577bf46ef6b7463d4dc524fcc28ee23b 100644
--- a/tools/remote_build/README.md
+++ b/tools/remote_build/README.md
@@ -32,7 +32,7 @@ bazel --bazelrc=tools/remote_build/manual.bazelrc test --config=asan //test/...
 Run on Windows MSVC:
 ```
 # RBE manual run only for c-core (must be run on a Windows host machine)
-bazel --bazelrc=tools/remote_build/windows.bazelrc build :all [--credentials_json=(path to service account credentials)]
+bazel --bazelrc=tools/remote_build/windows.bazelrc build :all
 ```
 
 Available command line options can be found in
diff --git a/tools/remote_build/manual.bazelrc b/tools/remote_build/manual.bazelrc
index c3c6af42877165dd90fe550296389e429ade7a1e..9819a9ffb36cae23ff8018961c06ae9e6343b54c 100644
--- a/tools/remote_build/manual.bazelrc
+++ b/tools/remote_build/manual.bazelrc
@@ -20,11 +20,10 @@ import %workspace%/tools/remote_build/rbe_common.bazelrc
 build --remote_cache=grpcs://remotebuildexecution.googleapis.com
 build --remote_executor=grpcs://remotebuildexecution.googleapis.com
 
-# Enable authentication. This will pick up application default credentials by
-# default. You can use --auth_credentials=some_file.json to use a service
-# account credential instead.
+# Enable authentication. Bazel will use application default credentials
+# unless overridden by --google_credentials=service_account_credentials.json
 # How to setup credentials:
-# See https://cloud.google.com/remote-build-execution/docs/getting-started#set_credentials
+# https://cloud.google.com/remote-build-execution/docs/results-ui/getting-started-results-ui
 build --auth_enabled=true
 
 # Set flags for uploading to BES in order to view results in the Bazel Build
diff --git a/tools/remote_build/windows.bazelrc b/tools/remote_build/windows.bazelrc
index 825d6765de9cd8a6e1f5fdc634c319a526f0b971..e9b418f9837e255a905e56d214da8a0f2e9e3c29 100644
--- a/tools/remote_build/windows.bazelrc
+++ b/tools/remote_build/windows.bazelrc
@@ -3,6 +3,8 @@ startup --host_jvm_args=-Dbazel.DigestFunction=SHA256
 build --remote_cache=grpcs://remotebuildexecution.googleapis.com
 build --remote_executor=grpcs://remotebuildexecution.googleapis.com
 
+build --auth_enabled=true
+
 build --host_crosstool_top=//third_party/toolchains/bazel_0.26.0_rbe_windows:toolchain
 build --crosstool_top=//third_party/toolchains/bazel_0.26.0_rbe_windows:toolchain
 build --extra_toolchains=//third_party/toolchains/bazel_0.26.0_rbe_windows:cc-toolchain-x64_windows